0b17347c45d8a799991949315bb4e9f62f1c8e7ff0356cf4897a8f12899b1b17

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEPlus.exe
Size 50KB
Sample260522-pc5arsav9n
SHA256 0b17347c45d8a799991949315bb4e9f62f1c8e7ff0356cf4897a8f12899b1b17
MD5 f47ddf193b7c5279a5eb6943b748f3ab
SHA1 c6085eb4ff890850ed37206d7b6aba3e5099361d
SHA512 fe883f683ce94178597f5d2b1388e56e87426b38f6799342fcc1b3c74f63b08361deb988edb38448946a3e3c3b37d8ed9a8e1bde14ece21ea00d983cda3a399f
SSDEEP 768:iTjyeTxK8dXpo6I0V513vlHKkPO85eO3yLAkXCZPo8HRu2Cu/+rhlg:2dTbdXyK51p3POScXCw8HRuZNq
TLSH
T12333E12D73449563F3FE8BB356A24A500E31A90694B2E3C8FCDDE127551278186F3B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_580519385\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_580519385\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_715947857\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4840_715947857\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CEPlus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
756	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239255419396015"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{8D8FD93D-219D-4922-B9C3-566722AB23B8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5864	msedge.exe
5864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 4840	6044	CEPlus.exe	99
PID 4840 wrote to memory of 2500	4840	msedge.exe	100
PID 4840 wrote to memory of 756	4840	msedge.exe	101
PID 4840 wrote to memory of 968	4840	msedge.exe	102
PID 4840 wrote to memory of 968	4840	msedge.exe	102
PID 4840 wrote to memory of 968	4840	msedge.exe	102
PID 4840 wrote to memory of 2300	4840	msedge.exe	104
PID 4840 wrote to memory of 2300	4840	msedge.exe	104
PID 4840 wrote to memory of 5540	4840	msedge.exe	105
PID 4840 wrote to memory of 5540	4840	msedge.exe	105
PID 4840 wrote to memory of 5540	4840	msedge.exe	105
PID 4840 wrote to memory of 1840	4840	msedge.exe	106
PID 4840 wrote to memory of 1840	4840	msedge.exe	106
PID 4840 wrote to memory of 1840	4840	msedge.exe	106
PID 4840 wrote to memory of 5852	4840	msedge.exe	108
PID 4840 wrote to memory of 5852	4840	msedge.exe	108
PID 4840 wrote to memory of 5852	4840	msedge.exe	108
PID 4840 wrote to memory of 4244	4840	msedge.exe	109
PID 4840 wrote to memory of 4244	4840	msedge.exe	109
PID 4840 wrote to memory of 4244	4840	msedge.exe	109
PID 4840 wrote to memory of 4064	4840	msedge.exe	111
PID 4840 wrote to memory of 4064	4840	msedge.exe	111
PID 4840 wrote to memory of 1820	4840	msedge.exe	112
PID 4840 wrote to memory of 1820	4840	msedge.exe	112
PID 4840 wrote to memory of 1656	4840	msedge.exe	114
PID 6044 wrote to memory of 3004	6044	CEPlus.exe	115
PID 4840 wrote to memory of 1880	4840	msedge.exe	117
PID 4840 wrote to memory of 1880	4840	msedge.exe	117
PID 4840 wrote to memory of 1880	4840	msedge.exe	117
PID 4840 wrote to memory of 5688	4840	msedge.exe	119
PID 4840 wrote to memory of 5688	4840	msedge.exe	119
PID 4840 wrote to memory of 5688	4840	msedge.exe	119
PID 6044 wrote to memory of 4496	6044	CEPlus.exe	120
PID 4840 wrote to memory of 4812	4840	msedge.exe	121
PID 4840 wrote to memory of 4812	4840	msedge.exe	121
PID 4840 wrote to memory of 4812	4840	msedge.exe	121
PID 4840 wrote to memory of 1816	4840	msedge.exe	122
PID 4840 wrote to memory of 1816	4840	msedge.exe	122
PID 4840 wrote to memory of 1816	4840	msedge.exe	122
PID 4840 wrote to memory of 6016	4840	msedge.exe	123
PID 4840 wrote to memory of 6016	4840	msedge.exe	123
PID 4840 wrote to memory of 6016	4840	msedge.exe	123
PID 6044 wrote to memory of 4472	6044	CEPlus.exe	124
PID 4840 wrote to memory of 4740	4840	msedge.exe	125
PID 4840 wrote to memory of 4740	4840	msedge.exe	125
PID 4840 wrote to memory of 4740	4840	msedge.exe	125
PID 4840 wrote to memory of 4724	4840	msedge.exe	126
PID 4840 wrote to memory of 4724	4840	msedge.exe	126
PID 4840 wrote to memory of 4724	4840	msedge.exe	126
PID 6044 wrote to memory of 3328	6044	CEPlus.exe	129
PID 4840 wrote to memory of 6008	4840	msedge.exe	130
PID 4840 wrote to memory of 6008	4840	msedge.exe	130
PID 4840 wrote to memory of 6008	4840	msedge.exe	130
PID 4840 wrote to memory of 3696	4840	msedge.exe	131
PID 4840 wrote to memory of 3696	4840	msedge.exe	131
PID 4840 wrote to memory of 3696	4840	msedge.exe	131
PID 6044 wrote to memory of 4308	6044	CEPlus.exe	133
PID 4840 wrote to memory of 540	4840	msedge.exe	134
PID 4840 wrote to memory of 540	4840	msedge.exe	134
PID 4840 wrote to memory of 540	4840	msedge.exe	134
PID 4840 wrote to memory of 3756	4840	msedge.exe	135
PID 4840 wrote to memory of 5728	4840	msedge.exe	136
PID 4840 wrote to memory of 4552	4840	msedge.exe	137
PID 6044 wrote to memory of 4852	6044	CEPlus.exe	138

C:\Users\Admin\AppData\Local\Temp\CEPlus.exe
"C:\Users\Admin\AppData\Local\Temp\CEPlus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x340,0x7ff97a82c188,0x7ff97a82c194,0x7ff97a82c1a0
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,2226290980295449238,3537190105305197299,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    - System Time Discovery
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,13614781171294076456,12339866055518766194,262144 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,1900222252325032872,15767090811317228843,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,5474150479821344749,3136662625266919073,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,7701726940907112261,2800852293655338921,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,14120734808944096779,11077122391107424392,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5100,i,8619398213293077726,1860906536763613965,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,10089826627222313726,6547195530084780979,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,15835720843910769236,1921686615584891897,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,3643647876853354368,8668358845945654741,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,3643647876853354368,8668358845945654741,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6116,i,15838606861555695520,12239683907422118727,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3476,i,3344386826772027953,6325869178822564190,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6232,i,2956334614299888849,9899011604914298727,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3688,i,1533928569311788368,17288938814604633755,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5788,i,13514296575548808531,12273284835085441312,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6200,i,11089464221887431213,12714600241772070933,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6248,i,634264341440191552,15965597893288073006,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6284,i,4029468669240453200,17425268306951656979,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6372,i,417021113856119733,9421639535040527897,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6288,i,3927267490397723561,9729129180769374212,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,9888104636954577751,13768233063378966068,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13358688632298374493,65412857608516589,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,14003317040936185432,14394247333330945961,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2024,i,5582563026862004434,15407125485094648670,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6204,i,9379152397497357418,10319827247233224834,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6592,i,13265442563884238644,17229526313888896618,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3676,i,4380610147959682615,6177640792044420785,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6436,i,9536483766597535358,6258766055833971403,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3720,i,1930466769939825207,12580199651207685682,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,5603153954314784640,12256810916192133942,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5212,i,17320568135012141619,1370606229279801535,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6300,i,12216742016530640712,6892900283194268875,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5024,i,12566321059398746083,16191107237977034294,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3688,i,3889681925658553934,6160890097262863515,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5992,i,2735292921579873744,10368334381047936593,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,13180555968777472515,7500405428919385783,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6128,i,16935350557838558542,15268362731528285263,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5216,i,12565422772076987940,17002159334742726928,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6460,i,12911583747063942706,17331087426401819281,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6000,i,8528278701292979163,4493503150736172589,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5432,i,8008696716925205319,3858530762148684797,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6288,i,10492489715668938886,12051984581937162670,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6172,i,4603012899997435407,10893772016088517159,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,2820341438715084396,10785195497743572275,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6476,i,9453684429395517909,16245368875052126999,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5192,i,9525348324067029950,5911383359388512094,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
    3⤵
    PID:176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6520,i,11462976993241871537,8249887145055957622,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5220,i,8655975201677727640,3102828855408384260,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6752,i,7877746506687684716,397332685729714974,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3372,i,6083171820409382923,14542241508585580342,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6500,i,3564054775177994220,12240669654715053033,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5180,i,14893767989827803709,11805242202618600211,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4988,i,13982375216091198500,5355989624152940961,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6376,i,18434938550782132011,2683619763764401790,262144 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=5348,i,11445162116984572393,12987226829465327065,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=6500,i,8803118728551285053,11386265963377932125,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,18414531122581403042,3510493909868147679,524288 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5112,i,13455199461332495289,6365085849043226918,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6980,i,6252584505876757692,5724714258371407509,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6880,i,12072330946418115674,7647313980209858244,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6148,i,11060960386400380224,3970435885568162632,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=5624,i,6814126268619767506,6416864136176571008,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=1112 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6968,i,10898256626815135223,6173106550174089116,2097152 --field-trial-handle=2340,i,13884559789281108033,6692238393410796009,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/
  2⤵
  PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4840_178501397\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4840_580519385\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4840_580519385\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4840_715947857\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 efb91d9b3cd8895cfb48f015389a08d524e1ed1a96fc7933bbc643a82f7bc6ca
MD5 1fbdd482926a61eda029e66207d617cd
SHA1 7e69926b05468ed04a7ed02fee87b19a4fe3dcd2
SHA512 f5da5f8987a21895bc1293407c80ffdef0a97ac85172c848d5c2d6abf8d872293a3227b46bb0a6899a1aedcf8fb4d6605ef74875ee2fd3a9191c7f0af88452f7
TLSH
T1E0F0F4B6DC21EC2B18FD1B6970598B4BFB5013273780985B3B3C820C8FB563B868681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a971798c0fec23f4411b78dd3d06200625530a849731aac259e1e8aa1f6d752c
MD5 7881cab5b6b0d39b358e573dce89a7df
SHA1 668484a6bc6cef93f38c031e923837dc9d493df8
SHA512 04258a85ed53e824c8b720d63cbad5558a3c6c13f60a45712e3ca11438e458a00e38ef607296ea48c33ec38fbf2722285348f78636e07a05d106407330c0c6df
TLSH
T14E41CCF3C3E8856E8A1156F0BA287E2FDE2D0910432C3D9A85E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 af9a133b2bed87dfb9b5f90f2c9744e824791daf99647408cb0fae5ebf11a480
MD5 f09b19bd21464d7140f6a6baf17901bf
SHA1 b8b2e90f604e41bd8b034f0f5979c4c7e0845baa
SHA512 6736268fa22438157b0bc9c0af2cb5f4ac757cf7881bfac3908f49dbdc6f12e8992e7c5b1fac8daf74910dad1737541383db736f2481adba4a3800e9e88a9195
SSDEEP 192:sxZ9RbyMqZjK1Ml8MjS/fyXsU1rZdIaRuvyzodpVnHW6+WNGYvg+vTIg5u/tJ:sxZ9w7S/fUsQrzIKYJ9HbG+jk/3
TLSH
T13262E9066A28597B8CD7D219FA55BB53D7F91173A2904E449AFCCB0C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 62d2dca4407ea029d5415be2d34a3c12a8b06aa7fc11ad54304f78546f783d1a
MD5 c756429de9e2b41838722789d6ac75ac
SHA1 945cd680a06a40532fd78618d86329989185d141
SHA512 352e557395cecd71d91c1c89654ae89fc3d43d4daa73397b7007033a7cd30e2b8dba2827bd21e6cb748d00bf00f8e65ddccb2983cecdc3acdc3e96cdddfe1deb
SSDEEP 192:sxZ9RbyMqZjK1Ml8UQajS/fyXsU1rZdIaRuvPzodpVDnHW6+WNGYvg+vTIg5u/tJ:sxZ9wqeS/fUsQrzIKYEJnHbG+jk/3
TLSH
T1E362F9066A28597B8CD7D219FA55BB53D7F81573A1904E4499FCCB0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 398993aeeb3d963f2f4c5b8ea8a0c0e356281bfe3788d3a78482da417f350b2f
MD5 921ff28c4655fe90e1c167f5ba181070
SHA1 1233110e7edf2121f3410b3a98a098cc946dd328
SHA512 8b9383e9e15aec211935102996f33a4aafba264b0f541b55708753986e9d8fdf4b108018fb65182f2812ee13da1f2e3bc3a10f37b415b137593604af3ba4aa06
SSDEEP 192:sxZ9RbyMqZjK1Ml8MjS/fyXss01waZdIaRuvezodpVFHW6+WNGYvIC+vTIgjxJ:sxZ9A7S/fUsswwazIKYFfHbGrjj7
TLSH
T16862E9066A28597B8DD7D219FA55BF53D7F81173A2944E449AFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 263a5ddd44befd8c0e218c6588e107bba07f5632228c907460ff52391b7981df
MD5 d5ef2cc9fbb30e21d9e12ee10495badd
SHA1 60d725bbfefbd1626b2ffe4a1c44775c1d2b9687
SHA512 8f89a9660401f71fcb917fd9f8a7273a1622489e4115df3a2c1806457ddf700b301f2d95fb118329b4799de7cd91af4ad0dbcb4531123981c17a69900f385900
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpysy10LlJ:eY8Od/HEnFhWvFvmXu1ja5t10Lm2NuXi
TLSH
T135F2FA3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 53bf8f8f8b892155e17703026e62664d9f03cbc5d873b9fe4826a86d4202cf96
MD5 8f3cd14cedc88d5f5b548d193621f106
SHA1 e44318b456e5d95a2ab060b394aef412dda33de8
SHA512 1da29d024e3ffade5e32fadefd20cf6d4d558d4fe2109b03e6a24ed1f71c3043c0d974a9f2492ba623dc6c7193e23566f41a5191a5d4ad4536fd4130c2259d74
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrZy:0LppY93PBZJPtN53Jp8y
TLSH
T116B27C5A703E0212397E2988B39596364F4235A33058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a2d0e23024b0276a2b2ad0d65e93a9ec412d2aa0555aa25d65b6d57301228799
MD5 cadf17280c86e56056520c60f79634a1
SHA1 83c89ba949c51594e6ba26378773310cccb0167d
SHA512 ca1ef16ecb2777e60567f9ad87f5e059b91b1a48500f918856a608a69f3005ac7d878fff60d64e21c565be4517ca269d1c87597a3e329ee946549fa7417c4d01
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lyKpvBftGp+Mgj4K6phe4KV8p0PHTt+:pAFccps3iwgbkUQkjGPVKSI8p0PU
TLSH
T18EB25C36EC68CABBEDE74F89B74A7A03DEE0126785D859E4DAD81D0C00971DC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1aaf63ff36f08dc7d3dc1b17d9e599711ade0a94af942a07622040f3de2d642e
MD5 e00c5c89c987412e7e3d6d1edda67465
SHA1 42325d01e1c3266da4221a7b3929e4b01f595d75
SHA512 5dafea7c374a3d933291b68bc2dc62d8159a34baa1cd90b9fd4af58578a1e84336abbd4acd90460955338d8bbe2636fdf9d42fae2e99db4e6956c17286462553
SSDEEP 384:ngiF1tNnNnb9XC3sNM8TUNTUlI4qQckCr5QzpvBftGp+Mgj4Q4LmSpJhg2GlP7VD:7F1jZbo3Bwg1kb9jGPVQRm2lPJTX
TLSH
T140D24B36E864CABBEDE74F85B71A7653AFE012A394D819D4DAC81E0D00D76DD130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c9161d684fc507a5c1e1d20404d7ae832d33553c7ed96d1c0ff183bb4f94b7c9
MD5 ead32b7ee2d764b0c837d5c0e15ae60c
SHA1 9968848775ba19cbff3aa4804e0b9e65ed05c282
SHA512 987dee456e816b09bd343c9f787542568dd3a6a16ccb9361ccc5def349bdad07e15dd583c7ee156699534dff85bcc660f15d4ac4a7a09516acbd0f4895ca72c7
SSDEEP 384:nDiF1tNnNnb9N3sNM8TUNTUlI4qQckCr5DPpvBftGp+Mgj4Q4LISpJhg2GlP7VMi:uF1jZbj3Bwg1kUBjGPVQ5m2lPJTX
TLSH
T1BAD24B36E864CABBEDE74F85B71A7653AFE012A3D4D819D4DAC81E0D00D76DD130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3b7c25377eb41bd682af5d235fb9d34de5b8076b12f514dac3c2f630df006f56
MD5 e5e149eb1169312d84f8258bbe92e92a
SHA1 88dc2d92186796711cec59d6613e7af797cd9d59
SHA512 ea35bb88a4758338d6a85c41bbdb5237259114f7f439d2504ae5a5d603ecece6c827395f534676d9227ddeb16fc5d16ef5cc1f112b7ad8cf2de8e9884bd6687c
SSDEEP 384:np5iF1tNnNnb973sNM8TUNTUlI4qQckCrMKfpvBftGp+Mgj4Q4LISpJhg2GlP7VD:pQF1jZbl3Bwg1k2RjGPVQ5m2lPJTX
TLSH
T12AD24B36E864CABBEDE74F85B71A7653AFE012A3D4D819D4DAC81E0D00D76DD130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 60c711a3bd96290fa4d7c54073f38af289184e8a3de78c7ac44490b00c512099
MD5 ac50ee21f0b18dea12574bfae891b074
SHA1 9be5fa513c558b1c10914c7232ba4366a63cca40
SHA512 9ae889509281fe03fcbd6d1aa5fb1a436a03bdff09694d362f8ae466f1b66efc9ceb48e1c65afba2c29fdf27823974a32516c690e997794151cb4da177cb7350
TLSH
T1BC3162E25D381AD1C4BD0EBFA4C734FC84E8D62AF1A4707E6854E9A4072C50E608143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d802ad6a002f50e7dc3ad29964def7e91682dff26fe6964ad73c8b4c84494b2d
MD5 ff178778d73685b0c18a174d5d2c7c25
SHA1 5e115ad096735a9f23607758c163ffa59f043b8b
SHA512 0c0b394943ae65ab86bdb3e3b27f3b0c7a6acba5f645d707dbe597e4f48cf9eae21a4420054d6da9df741e45576b8883d23568916443680f4c7d4a0078d844bf
TLSH
T1F44175E25C391AD1C4FD0A7EB4D778FC84D8C32AF1A4707E2858D9940729A0E748143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cd8947a6f4b5d5fde3b39e542cc767bff019f775058de5d0ff7b76d6e652e163
MD5 ab8e639dcb0f349ae295e4953479493a
SHA1 aa4535c4ec87fa6380301478eec0a1250be7a0a5
SHA512 ced88b38eb7116848505f3f250811fdd3e6f8b1e1bfb0f0df895b2c0167242fdd8aab55cf7912f512c9873c415af2ee4b09da922b4089c3c2f74686c6cda1838
TLSH
T1213156F25D391AD1C4FD09BFB4D778FC94D9C326F1A4707A6854D9A4072960E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 654dcb618e04d240603597e489d9477e5d44305113ceb1439d5cddb949e27a54
MD5 a760326673fabfdd4780632a77eb0ae6
SHA1 2dbffdda7850be7052ad81b941e37846f65e9ddc
SHA512 774409ce7d4ac8fe848509004c0a8d9f9b90b1019f32b96fba2f65dc6eec83b30662b7f1936ea7009db50040110afc8ad72272d6bf6c694ec0ed2b62651501aa
TLSH
T182411698A6FA1108B3B77F5A9FF2A86E447E79772F07945D00010D4F0A62A40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1656-194-0x0000022580000000-0x0000022581000000-memory.dmp

Download

memory/6044-3-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/6044-4-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/6044-2-0x00000000056A0000-0x0000000005732000-memory.dmp

Download

memory/6044-39-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/6044-1-0x0000000005D80000-0x0000000006324000-memory.dmp

Download

memory/6044-0-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

Download