Analysis
- user interaction
yes - max time kernel
672s - max time network
712s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 15:00
General
- Target Topaz Video AI 3.1.10 (lofix)/TopazVideoAI-3.1.10.msi
- Size 652.9MB
- Sample260903-sdtr7saa38
- SHA256 eb0db8b8cb8703c79a7df53168db1adc917e342d4d32ec8532339282e829ef00
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 64 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 37 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 6 IoCs
- Suspicious behavior: EnumeratesProcesses 61 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI 3.1.10 (lofix)\TopazVideoAI-3.1.10.msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4CAF3E0F39B6AA162C5C6475FEBC90DD C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0D0F18E706AADE64B40E6C6B523F87EB C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\Topaz Video AI.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\Topaz Video AI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\crashpad_handler.exe"C:/Program Files/Topaz Labs LLC/Topaz Video AI/crashpad_handler.exe" "--attachment=main.txt=C:/Users/Admin/AppData/Roaming/Topaz Labs LLC/Topaz Video AI/logs/2026-09-03-16-12-27-Main.tzlog" "--attachment=out.txt=C:/Users/Admin/AppData/Roaming/Topaz Labs LLC/Topaz Video AI/logs/2026-09-03-16-12-27-Out.tzlog" "--database=C:/Users/Admin/AppData/Local/Temp/Topaz Labs LLC/Topaz Video AI/Crashes/db" "--metrics-dir=C:/Users/Admin/AppData/Local/Temp/Topaz Labs LLC/Topaz Video AI/Crashes/db" --url=https://submit.backtrace.io/topazlabs/b060552e9793d86dec356a038dee056ebd3b4d539c702a0e5c8f3760d7a99f98/minidump "--annotation=appName=Topaz Video AI" --annotation=appVersion=3.1.10 --annotation=email=Unspecified --annotation=format=minidump --annotation=token=b060552e9793d86dec356a038dee056ebd3b4d539c702a0e5c8f3760d7a99f98 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4b4,0x4e8,0x7ff7f05c5918,0x7ff7f05c5930,0x7ff7f05c59484⤵
- Executes dropped EXE
-
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\login.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\login" status4⤵
- Executes dropped EXE
-
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\login.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\login"4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://topazlabs.com/oauth/authorize?client_id=XbU0xqXX0H1U4GsI3B3xIzJwVY3KL3grXhUTm28K&response_type=code&state=517705⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x334,0x7ffa35dcc188,0x7ffa35dcc194,0x7ffa35dcc1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,4622083954699186862,7410030360244618982,262144 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,16748771375519217955,16811801571624982811,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,8062183199262487050,5356512550222108164,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5922721100879339491,13825838876118648808,2097152 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,5613884408490661805,4395305126002458277,2097152 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,1640166778089914864,11098134562688864303,2097152 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4416,i,15387271256643388121,14951665566949079993,2097152 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,1409710446363388115,12918724421952049355,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,12197019619628838319,15094485172289559348,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,31252478835245,7970675068903991979,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,12724512869051941117,11796394694495556042,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6404,i,5242855553152676604,2738853677792723394,2097152 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,12724512869051941117,11796394694495556042,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12900112586561159073,13662046178207296666,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,3270768695250863721,9512558685231119614,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,18293317267923422899,15484486510953207075,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,13753300007113252442,15373458015131685544,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,11582082416177617123,11587717655649642827,524288 --field-trial-handle=2008,i,5572833534806668944,12294334733389529261,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:86⤵
-
-
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 24753CB213C41DF180348FEFA727859C2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1879154B9670ED3372124751BAB54579 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\Topaz Video AI.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\Topaz Video AI.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\crashpad_handler.exe"C:/Program Files/Topaz Labs LLC/Topaz Video AI/crashpad_handler.exe" "--attachment=main.txt=C:/Users/Admin/AppData/Roaming/Topaz Labs LLC/Topaz Video AI/logs/2026-09-03-16-14-46-Main.tzlog" "--attachment=out.txt=C:/Users/Admin/AppData/Roaming/Topaz Labs LLC/Topaz Video AI/logs/2026-09-03-16-14-46-Out.tzlog" "--database=C:/Users/Admin/AppData/Local/Temp/Topaz Labs LLC/Topaz Video AI/Crashes/db" "--metrics-dir=C:/Users/Admin/AppData/Local/Temp/Topaz Labs LLC/Topaz Video AI/Crashes/db" --url=https://submit.backtrace.io/topazlabs/b060552e9793d86dec356a038dee056ebd3b4d539c702a0e5c8f3760d7a99f98/minidump "--annotation=appName=Topaz Video AI" --annotation=appVersion=3.1.10 --annotation=email=Unspecified --annotation=format=minidump --annotation=token=b060552e9793d86dec356a038dee056ebd3b4d539c702a0e5c8f3760d7a99f98 --initial-client-data=0x4d4,0x4d8,0x4dc,0x4b0,0x4e4,0x7ff7f05c5918,0x7ff7f05c5930,0x7ff7f05c59482⤵
- Executes dropped EXE
-
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\login.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\login" status2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://topazlabs.com/cart?add-to-cart=1464951&utm_medium=app&utm_source=appLogin2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://topazlabs.com/cart?add-to-cart=1464951&utm_medium=app&utm_source=appLogin3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x214,0x7ffa35dcc188,0x7ffa35dcc194,0x7ffa35dcc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,1801676040436711596,7595493306411513879,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,13926831254119126901,5092500080246973812,262144 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,12958807483686847316,3126550809657079624,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16341000532540817907,14699058527016367907,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,18418526022145414361,12293892377213851043,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,4958790764584086394,15834168780810874040,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5096,i,17137031100101776100,10368938073501745648,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5300,i,2052523261364738216,17062540909519847066,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5472,i,6731150271137029606,4705156282320536494,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9076813536966159942,3998509448729968762,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3908319088893962771,6394702000387404620,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8287800517972789370,14968144575015598125,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8287800517972789370,14968144575015598125,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5664,i,13439051476628029862,16460561208392320742,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6980,i,9845249719461472492,544934365072161495,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7132,i,8578696655461340405,5057161837000585442,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,8911325687388933181,14351645179689234367,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7540,i,16439303201358479275,11397914662283538848,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7688,i,9343207047805525301,4941320014930675254,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,5557746886508344524,15369442463449534151,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7896,i,4239604049255204931,10066455382026505771,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,6963009645247798725,11177751424041952196,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6960,i,9653805599195289699,14453535684637759711,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,4813056440932723465,11130857062728133177,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,3904993523972271746,15487196957242239189,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:84⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8620,i,12684202118447842988,6640103282792470523,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8120,i,12898636898205809886,1090274574969497577,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8504,i,10964310112632651379,17275115186323590171,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8176,i,9165145766894604159,9977609066734350672,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8920,i,8885052269046819096,15542031573204691664,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7524,i,15080006306826870908,2508456345937768506,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7660,i,3182667125010889642,13758333478919782024,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7860,i,632452007574818838,5334247715395605023,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9256,i,11442872220337990515,432836837866983113,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,12438901600167861573,5092980429325440071,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8152,i,9975835791922253822,17098260924352071836,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8032,i,309622042404203522,87388504688131017,2097152 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=9476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,1961468533270458363,9611390412907292841,524288 --field-trial-handle=2268,i,3182395011701298686,465908570871070968,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x198,0x7ffa35dcc188,0x7ffa35dcc194,0x7ffa35dcc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,13839962148791916948,7148256570289610611,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,9603105435482047773,13630179974264786168,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9456449335506281862,8044378743055393998,262144 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4919770828836887350,10178801185618280901,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4919770828836887350,10178801185618280901,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16300403583825483445,17494859281206354422,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,10960657997876427548,6962542778351920997,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,4327487810771164293,13602020594072508254,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4912,i,17750386500451169298,13380038681960336680,262144 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,3041584633070168594,6254414893401216695,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,9136990360168939168,15071789434211642231,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,11697605278143272401,9140042507371468907,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9330203817701728261,12092707449816903650,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,17865594588413510985,9371268484337262780,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,311027183495377261,3142616971022358727,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,14465287004782261911,14118260347823234068,524288 --field-trial-handle=2468,i,16837423239182982522,17412928494957670378,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:85⤵
-
-
-
-
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\login.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\login"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://topazlabs.com/oauth/authorize?client_id=XbU0xqXX0H1U4GsI3B3xIzJwVY3KL3grXhUTm28K&response_type=code&state=536163⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://topazlabs.com/oauth/authorize?client_id=XbU0xqXX0H1U4GsI3B3xIzJwVY3KL3grXhUTm28K&response_type=code&state=536164⤵
-
-
-
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\ffmpeg.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\ffmpeg" -hide_banner -t 1 -i "C:/Users/Admin/Desktop/5 sec video ad (sample 2).mp4" -c:v prores_ks -profile:v 1 -vendor apl0 -quant_mat lt -bits_per_mb 525 -pix_fmt yuv422p10le -c:a copy "C:/Users/Admin/AppData/Local/Temp/799892184/previews/5 sec video ad (sample 2)_tvai.mov"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Topaz Labs LLC\Topaz Video AI\ffmpeg.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\ffmpeg" -hide_banner -nostdin -y -nostats -i "C:/Users/Admin/Desktop/5 sec video ad (sample 2).mp4" -sws_flags spline+accurate_rnd+full_chroma_int -color_trc 1 -colorspace 1 -color_primaries 1 -filter_complex tvai_fi=model=chf-3:slowmo=1:rdt=0.01:fps=60:device=0:vram=1:instances=1,tvai_up=model=prob-3:scale=0:w=3840:h=2160:preblur=0:noise=0:details=0:halo=0:blur=0:compression=0:estimate=20:device=0:vram=1:instances=1,scale=w=3840:h=2160:flags=lanczos:threads=0,scale=out_color_matrix=bt709 -c:v prores_ks -profile:v 1 -vendor apl0 -quant_mat lt -bits_per_mb 525 -pix_fmt yuv422p10le -map_metadata 0 -movflags "frag_keyframe+empty_moov+delay_moov+use_metadata_tags+write_colr " -map_metadata:s:v 0:s:v -map_metadata:s:a 0:s:a -c:a copy -metadata "videoai=Slowmo 100% and framerate changed to 60 using chf-3 ignoring duplicate frames. Enhanced using prob-3 auto with recover details at 0, dehalo at 0, reduce noise at 0, sharpen at 0, revert compression at 0, and anti-alias/deblur at 0. Changed resolution to 3840x2160" "C:/Users/Admin/Desktop/5 sec video ad (sample 2)_chf3_prob3_temp.mov"2⤵
- Executes dropped EXE
- Network Service Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\5 sec video ad (sample 2)_chf3_prob3_temp.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\5 sec video ad (sample 2)_chf3_prob3_temp.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4118c728,0x7ffa4118c734,0x7ffa4118c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1972,i,3799721366091031065,4712842925792228440,262144 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,9534036505152437794,9269242804047196240,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2176 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,8522205721480458048,14465574927207526738,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3340,i,8572245338194337009,1469583547275647935,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3576,i,6498131332128369648,1448768024384535720,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,3978917697395636661,12856436508980317956,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,6144937881948501370,13894305626874922139,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,12963987742206533832,17925821649095561181,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5544,i,7022045649708704115,11240652834354624749,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3704,i,17634897949382270749,384456347128228053,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3400,i,18121136356741106866,9391532658437187637,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,7421311908594256022,17150960820822728569,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6432,i,408170756870798758,14153229064649175864,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5516,i,12979702142750930010,3636978488151374723,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,11342767399181186051,7718908313476371106,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:82⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,13076257674248139318,6944055055507214106,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,15183030180529288304,18084768084903566178,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6792,i,5023234169651316615,5884744524370378549,524288 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6704 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4652,i,8057854337181642529,9188338969641176657,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4704,i,14535459010535662677,10928428735785893147,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=2932,i,16034146452935396995,10537227544758182159,2097152 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6816,i,3361973496543578250,5067083364702430751,262144 --field-trial-handle=1988,i,9194903202758811120,4668642881952638527,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e58d732.rbs
plugins.qmltypes
manifest.json
manifest.json
manifest.json
aaa-10.json
aaa-9.json
ahq-10.json
ahq-11.json
ahq-12.json
alq-10.json
alq-12.json
alq-13.json
alqs-1.json
alqs-2.json
amq-10.json
amq-12.json
amq-13.json
amqs-1.json
amqs-2.json
apa-1.json
apb-1.json
apo-1.json
apo-4.json
apo-5.json
apo-6.json
apo-7.json
apo-8.json
benchmarks.json
chf-1.json
chf-2.json
chf-3.json
chr-1.json
chr-2.json
cpe-1.json
cpe-2.json
ddv-1.json
ddv-2.json
ddv-3.json
dtd-1.json
dtd-3.json
dtd-4.json
dtds-1.json
dtds-2.json
dtv-1.json
dtv-3.json
dtv-4.json
dtvs-1.json
dtvs-2.json
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_622FF18A3B1CFCB8CC579FBC66AAEA0E
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_622FF18A3B1CFCB8CC579FBC66AAEA0E
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
BrowsingTopicsState
f_00001f
f_000023
temp-index
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe60eae1.TMP
the-real-index
Local State
Local State
Local State
Local State
Local State
blocklist
protocols.json
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
f_0000a8
f_0000a9
f_0000aa
f_0000c5
f_0000d5
f_000111
the-real-index
the-real-index
the-real-index~RFe59b665.TMP
SiteList-Enterprise.json
Edge Profile.ico
000008.ldb
000009.log
000011.ldb
CURRENT
LOG
MANIFEST-000001
MANIFEST-000001
1342f397-6a90-4d92-8679-5dfb63657c21.tmp
4608b9a1-c411-4994-94b2-9bb3c01a56fc.tmp
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
TransportSecurity
MANIFEST-000001
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
index
the-real-index
the-real-index
the-real-index~RFe5c16ac.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5bfb16.TMP
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5be953.TMP
index.txt
the-real-index
the-real-index~RFe5caca3.TMP
sync_diagnostic.log
the-real-index
the-real-index~RFe5cf4b8.TMP
index.txt
index.txt
index.txt
index.txt~RFe5ca3f8.TMP
b220444d-8f23-4210-bf25-c5e89320a749.tmp
f418c4c8-e57a-4ca9-8e18-fcc74bc98993.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
manifest.json
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5bf8d4.TMP
data_1
manifest.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
02880212-df78-4f4f-a0be-9cb4ee711aa3.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
7ea6d847-7953-4319-9e16-e41020007d34.tmp
MSIAF17.tmp
MSICA70.tmp
d74f5822-e692-48aa-a98e-61c552276249.tmp
357f7f13-63a5-4359-883d-ac3170d4ecb6.tmp
content_new.js
6a2d59b9baed23d3ef50b8411b7a73a353383ec1.qmlc
default.dic
ccba5a5986c77e43.customDestinations-ms
ml.xspf.tmp5728
5 sec video ad (sample 2).mp4
MSIF431.tmp
memory/2404-1211-0x0000023C8E720000-0x0000023C8E721000-memory.dmp
memory/2404-1196-0x0000023C8E6F0000-0x0000023C8E6F1000-memory.dmp
memory/2404-1206-0x0000023C8E710000-0x0000023C8E711000-memory.dmp
memory/2404-1207-0x0000023C8E710000-0x0000023C8E711000-memory.dmp
memory/2404-1209-0x0000023C8E720000-0x0000023C8E721000-memory.dmp
memory/2404-1204-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1176-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1203-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1221-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1178-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1219-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1222-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1223-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1220-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1175-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1187-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1188-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1189-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1173-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1191-0x0000023C8E6F0000-0x0000023C8E6F1000-memory.dmp
memory/2404-1217-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1184-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1183-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1179-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1180-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1192-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1193-0x0000023C8E6F0000-0x0000023C8E6F1000-memory.dmp
memory/2404-1194-0x0000023C8E6F0000-0x0000023C8E6F1000-memory.dmp
memory/2404-1181-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1186-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1195-0x0000023C8E6F0000-0x0000023C8E6F1000-memory.dmp
memory/2404-1177-0x0000023C8BD60000-0x0000023C8BD61000-memory.dmp
memory/2404-1198-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1199-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1200-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1212-0x0000023C8E710000-0x0000023C8E711000-memory.dmp
memory/2404-1202-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1213-0x0000023C8E720000-0x0000023C8E721000-memory.dmp
memory/2404-1214-0x0000023C8E720000-0x0000023C8E721000-memory.dmp
memory/2404-1154-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1155-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1156-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1157-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1158-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1153-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1148-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1201-0x0000023C8E700000-0x0000023C8E701000-memory.dmp
memory/2404-1149-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1147-0x0000023C8E5C0000-0x0000023C8E5C1000-memory.dmp
memory/2404-1142-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1143-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1216-0x0000023C8E730000-0x0000023C8E731000-memory.dmp
memory/2404-1144-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1145-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1146-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1141-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-1140-0x0000023C8BD00000-0x0000023C8BD01000-memory.dmp
memory/2404-839-0x0000023C88AD0000-0x0000023C88F10000-memory.dmp
memory/2404-841-0x0000023C88F10000-0x0000023C89110000-memory.dmp
memory/2404-838-0x00007FFA3DD90000-0x00007FFA3E34F000-memory.dmp
memory/2404-837-0x00007FFA3D8C0000-0x00007FFA3DD84000-memory.dmp
memory/2404-1185-0x0000023C8C580000-0x0000023C8C581000-memory.dmp
memory/2404-1210-0x0000023C8E720000-0x0000023C8E721000-memory.dmp
memory/2404-1218-0x0000023C8E730000-0x0000023C8E731000-memory.dmp