1135736a2bd67edae4a0b87e9978c8cfb6e182b631d50c21d5f4e743279bc7aa

Analysis

max time kernel
92s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Size 18.9MB
Sample260602-clb95abt9s
SHA256 1135736a2bd67edae4a0b87e9978c8cfb6e182b631d50c21d5f4e743279bc7aa
MD5 a7d48eae500a0593a62b243f773183fd
SHA1 fdeab65707e8e01d9cd4d9d60f260dd6be2f8a30
SHA512 9242af8b6f393f3a4f7c4dd1a6cdeeb0967c6f3cc613472d9a2a7ef336bb187e4e3e6226c673305c91d1c5bf8c60638756ab916309eeb1a37fcda4d209ee740a
SSDEEP 393216:XxqELLSH49mztq0eP+NRqp+mLPrv0NddtqjCfOJi0MwP:BCYckXhzsNddyLHZP
TLSH
T125171232E750CE36F542253492535AF9D12B5E199B2441C7A69CBF0A3AB37D03BFD282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Animated Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe"	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Animated Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe"	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2020	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248398405196202"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{9FCB8B5A-F633-402E-B68F-1853AF4F0C3B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2024	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
2024	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2024	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
2024	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1368	1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe	83
PID 1368 wrote to memory of 4400	1368	msedge.exe	84
PID 1368 wrote to memory of 2020	1368	msedge.exe	85
PID 1368 wrote to memory of 3376	1368	msedge.exe	86
PID 1368 wrote to memory of 3376	1368	msedge.exe	86
PID 1368 wrote to memory of 3376	1368	msedge.exe	86
PID 1368 wrote to memory of 4896	1368	msedge.exe	87
PID 1368 wrote to memory of 4896	1368	msedge.exe	87
PID 1368 wrote to memory of 1620	1368	msedge.exe	89
PID 1368 wrote to memory of 1620	1368	msedge.exe	89
PID 1368 wrote to memory of 1620	1368	msedge.exe	89
PID 1368 wrote to memory of 4008	1368	msedge.exe	90
PID 1368 wrote to memory of 4008	1368	msedge.exe	90
PID 1368 wrote to memory of 4008	1368	msedge.exe	90
PID 1368 wrote to memory of 772	1368	msedge.exe	93
PID 1368 wrote to memory of 772	1368	msedge.exe	93
PID 1368 wrote to memory of 772	1368	msedge.exe	93
PID 1368 wrote to memory of 1388	1368	msedge.exe	92
PID 1368 wrote to memory of 4828	1368	msedge.exe	94
PID 1368 wrote to memory of 1436	1368	msedge.exe	95
PID 1368 wrote to memory of 1388	1368	msedge.exe	92
PID 1368 wrote to memory of 1388	1368	msedge.exe	92
PID 1368 wrote to memory of 4828	1368	msedge.exe	94
PID 1368 wrote to memory of 4828	1368	msedge.exe	94
PID 1368 wrote to memory of 1436	1368	msedge.exe	95
PID 1368 wrote to memory of 1436	1368	msedge.exe	95
PID 1368 wrote to memory of 3488	1368	msedge.exe	96
PID 1368 wrote to memory of 3488	1368	msedge.exe	96
PID 1368 wrote to memory of 4428	1368	msedge.exe	97
PID 1368 wrote to memory of 4428	1368	msedge.exe	97
PID 1368 wrote to memory of 1404	1368	msedge.exe	98
PID 1368 wrote to memory of 4364	1368	msedge.exe	99
PID 1368 wrote to memory of 1404	1368	msedge.exe	98
PID 1368 wrote to memory of 4364	1368	msedge.exe	99
PID 1368 wrote to memory of 1760	1368	msedge.exe	100
PID 1368 wrote to memory of 1760	1368	msedge.exe	100
PID 1368 wrote to memory of 1760	1368	msedge.exe	100
PID 1136 wrote to memory of 2732	1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe	101
PID 1368 wrote to memory of 2068	1368	msedge.exe	102
PID 1368 wrote to memory of 2068	1368	msedge.exe	102
PID 1368 wrote to memory of 2068	1368	msedge.exe	102
PID 1368 wrote to memory of 3668	1368	msedge.exe	103
PID 1368 wrote to memory of 3668	1368	msedge.exe	103
PID 1368 wrote to memory of 3668	1368	msedge.exe	103
PID 1136 wrote to memory of 2056	1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe	104
PID 1368 wrote to memory of 4868	1368	msedge.exe	105
PID 1368 wrote to memory of 4868	1368	msedge.exe	105
PID 1368 wrote to memory of 4868	1368	msedge.exe	105
PID 1368 wrote to memory of 5104	1368	msedge.exe	106
PID 1368 wrote to memory of 5104	1368	msedge.exe	106
PID 1368 wrote to memory of 5104	1368	msedge.exe	106
PID 1136 wrote to memory of 2160	1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe	107
PID 1368 wrote to memory of 5116	1368	msedge.exe	108
PID 1368 wrote to memory of 5116	1368	msedge.exe	108
PID 1368 wrote to memory of 5116	1368	msedge.exe	108
PID 1368 wrote to memory of 1708	1368	msedge.exe	109
PID 1368 wrote to memory of 1708	1368	msedge.exe	109
PID 1368 wrote to memory of 1708	1368	msedge.exe	109
PID 1136 wrote to memory of 5088	1136	2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe	110
PID 1368 wrote to memory of 3996	1368	msedge.exe	111
PID 1368 wrote to memory of 3996	1368	msedge.exe	111
PID 1368 wrote to memory of 3996	1368	msedge.exe	111
PID 1368 wrote to memory of 4248	1368	msedge.exe	112
PID 1368 wrote to memory of 4248	1368	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2024

C:\Users\Admin\AppData\Local\Temp\2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
C:\Users\Admin\AppData\Local\Temp\2026-06-02_a7d48eae500a0593a62b243f773183fd_elex_remcos_stop.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2b8,0x374,0x7ffaf026c188,0x7ffaf026c194,0x7ffaf026c1a0
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,3699100018104661741,9728414111217295268,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,16945025894433632923,2830107190569213814,262144 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,13270410976633411521,7529849636813978638,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,5079784304804179754,7079936406594191689,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11789052190800190999,13898627899321855329,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,17581758466493246965,694177803271010134,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,3917022890084002691,14528904864868930501,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:9
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4268,i,8043024241162096951,17878687722265104478,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,17119843316962792736,15910800453731280629,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,13597326616587829708,6557809319225417612,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16211864463802158311,1093711220287365161,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,8244001051029390333,12409626417653961941,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,18429167323304085145,10359089628068609105,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5972,i,2189251303251263025,425323518910114354,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6196,i,8979705590603738456,888719017129856614,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6376,i,5767808587047460006,13914911815033045762,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5532,i,16687432857386157299,8409801170813198368,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3540,i,811087591784568176,2046687483750777785,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4756,i,2784457068142707804,10671049132183342886,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6800,i,7413258098995620919,1944099202919013411,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4184,i,10705320289015879373,1334127190063916379,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3624,i,3925541182109654641,4598865263201599624,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4360,i,16085925595507566769,10783646225831713421,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5172,i,14470661753912463461,11506796705247982975,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,4105086669253212380,15945312331242764573,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,5716474729535585545,12636458436528219781,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,6258804178577509776,18425803268614930287,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7524,i,17699695748626293970,18205328925758368621,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:14
    3⤵
    PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3396,i,2030188101592511347,9498816042640825935,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7644,i,14859330699886835614,8478572475148614096,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,8052844688886221143,7635286320925861324,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,8052844688886221143,7635286320925861324,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8024,i,4122782096006816403,265961495001721240,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7256,i,14868325474776775388,7037988114387745658,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7656,i,873931234891437380,3025899824159656923,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8152,i,8492799171912516602,17953778528143613097,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:1
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7420,i,7932766816962516158,3184442499252511463,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7212,i,7107402752677180440,14254148345533925611,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7696,i,6507031078061260620,8047555537947936513,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8564,i,5227420660726414433,11417360003958464029,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,3016496941415158854,6480227223416254617,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:14
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6096,i,15758244612048582666,3740863272351326407,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8888,i,5914037603618572588,15402187131457217363,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9172,i,8730278012964410737,5385552742448173312,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9308,i,10473248415542969188,1166015881642726124,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9332,i,2457943126655228717,8354365528632280255,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9556,i,86382747779015743,3150412214354194119,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9812,i,12571150238692073733,6506137424008697558,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9844,i,15040899254742907010,3814220589060572812,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9840 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9824,i,5705165409374475557,10443729437794015905,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9580 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9912,i,10856798791698341158,10481768394673532136,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:14
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7464,i,7815697861755039055,3119559560615173071,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9560,i,10557670798981732351,13739202170217355820,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9116,i,11956801206728954673,4478125825799895266,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:1
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8500,i,5762544249327008186,4351602599653770759,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6652,i,4962433383127678743,17817627870721750975,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10200 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10048,i,11908029154158553262,3445520901259511745,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9724,i,4486590178617839594,7462735599057508083,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7952,i,15739491752575664567,4835763070299382858,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9824,i,4102067157861957338,5011207630821979047,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10044 /prefetch:14
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9736,i,6074508597185729619,8126351368339606981,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:1
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9636,i,13699728099287524328,15316984680815047432,524288 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:14
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9844,i,9529504302974951190,9032699112953916184,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10356,i,14185673164200282703,1485685070477571292,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10372 /prefetch:1
    3⤵
    PID:7088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9528,i,1107901679966915846,15357795086684062430,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9476 /prefetch:1
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8588,i,914528137029851796,11293100684332054837,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10672 /prefetch:1
    3⤵
    PID:6440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9580,i,7004117193212521555,12706408113423601250,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9656,i,17876723232113820077,7820413153503842726,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:1
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10452,i,8671654779695698893,16052614714750399897,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8664,i,1678547928466724534,8570570136519438046,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:1
    3⤵
    PID:7156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=10868,i,4086033217476556213,14144022686940312906,262144 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:10
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10924,i,1261569472155345446,16924218759038245078,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10624 /prefetch:1
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10960,i,11802346114579924927,1151148396897862306,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10940 /prefetch:1
    3⤵
    PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9972,i,1190512174857633727,12682321033419584350,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=10836 /prefetch:1
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=3428,i,5050417525408919589,230587536087132577,2097152 --field-trial-handle=2536,i,13068025734903603595,4813738630008804900,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:6740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://www.screensavergift.com/DesktopAnimated.php"
  2⤵
  PID:6660

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84f93aada54ab9d4198f4921835374215ce568da47534a026f45ea8aeac3c46d
MD5 5a38b5bb38fa608c999388c083a63995
SHA1 e5d3aba11f7541cb3987ded0d4931654ac57f88f
SHA512 8e31c6074e12102606b65295b295122c504a35075c1ad6caa59242acf496386d939e5e435d1968c2146efd96b946d416b170b73c5bc2c43c9dfdb9267964c573
TLSH
T12F611ED8CA9E88B7E3302AFFD8D1720AF472416D0AE7BD463DC068BC7206B65831D464
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c68a7628af0a5c7fc6670bea265640bda9f4921a7f048df00149e53592f36853
MD5 76470d2754b948e94bb1fa23b8e75ebe
SHA1 a7a986e0e82f362973bb1685059992ed0449318d
SHA512 395947bb40fa3ce5330b75afa8213c5bef355aaba5c6ab4495cb5e69b5f566c37b92d9661ebf14cf53f2a204bb1a7ef21f3a51c05ffee2f154a0b2909cb861ab
TLSH
T193519EF3C3D8866D991156F1AA24AE1BCE6D0914432C3C5AC9E8FF0F93E2475E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9b93e7bd69e1c2046416b06acb44a2d7580c2f9295644057eb3bb8ed7c43035f
MD5 5df6d260786a8e7dbc24efffe67bb858
SHA1 6d5c116ffc94ec9265703ba0b8c2e13549801d17
SHA512 9d5083001847587fb2d4d0a1dbff121cdabb1824e40255247886e4f0a5b459698c1f44422fd42a46b7ab2749a6a30bec95b7689e205621cfc467c532674cc95c
SSDEEP 192:zZMR/yM/jK1Ml8McN/f1sr+lcdEdpIj/W6+WN99LfY0alO+rzIgyJ:zZMZ0N/f1sr+lc2i/bLf5REO
TLSH
T1E942E956AB345977CCDBD209F951BB53D6F9057392901E44AAFC9B1C00E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a9d3b9e1f42ab5fc4232d4697cefc37dffdb711f1f763e7909bd4a14f3042641
MD5 a4b98c2dc86d25fd2b28fe189524d659
SHA1 89f1fbfff4556f346b677e6d4b82f9d5f4f2f138
SHA512 84fd3458d4f00a2533f012a73c3690a55747f291e0108dca2a42c83afa8f50a935311e62adef65b583806fe8aba0b5b310665f93e5c727662ba41185170127a5
SSDEEP 192:sxZMR/yM/jK1Ml8McN/f1sL+7c6EdpIG/W6+WN9hWhY0aYO+rzIg50J:sxZMZ0N/f1sL+7cdn/bih5OEa
TLSH
T19E52E716AB349977CCDBD209FA55BB53D6F9146392501E44AAFCDB0C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c07ab960a74ada96efb103fbc4d67b3612d65874e6edb0fa79187deeaf527e06
MD5 a66ddf73a486ddbaf4811ddd99446698
SHA1 c3acb608b2a2943655a4bc7a3bb6749f5374c395
SHA512 0ee1b9b0643889998ab366abccabecb70bc1a664687f48537300ac0fffec559e960ba9077cf57b89233c730ff2862c6d9362dbf241aa9aa7827425722d0c44db
SSDEEP 192:sxZMR/yM/jK1Ml8UQOcN/f1sL+7cyhWafIdpmK/W6+WN9QvhY0aJA+rzIg56J:sxZMZqtN/f1sL+7c3h9/b6h5/EU
TLSH
T1F662E616AB349977CCDBD209F645BF53D6F9146392901E44AAFCDB0C01E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 5b55ecd80d5f8a80b445034c03aa0062d03eef470ca92a4aeabfe20476b862b1
MD5 2ad8b193f18aae85e98d4a56af1e63de
SHA1 4f66dfbc8852d7aac7af5419b5f3cc5bdd485f3f
SHA512 5746b5a6589d60c6a4e0859295e638cb750b6098a70884953f7434cbd6c766d995ecd98447d1bacd79710ffd581c83d4100c7a6e37a60205449a2c0ec3685209
SSDEEP 768:R4/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0Va3roSS:R4/zh8dF2PkWRmEcQXwu1jaKWjLp2tVR
TLSH
T1DAE21A2F284CC7BE4F844E9CEC266F976EE801CB66684D5447FA894C03C76DB521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e39759aa48010ecd4c41cdf39de2f89569f3b0cc51f1281f613bc6a228dc8092
MD5 65c80ca1d2197e0e974a1e298ec21227
SHA1 5bc9bacf839ed30347d5234806649448721f2303
SHA512 fac2a42a4b0f180546594d9dde7fb362d034c5cf2bd0c378d133fb02167de94ddf4fd40b568b916f922370e7950809d99526159a634ba468c4d3be1384afcc64
SSDEEP 96:KEWgKvLyYK7SaqOkKfKa2l6KGkPQTOKI6erLOpa9SrK1S9sr5Q4h2eYg:2gfvHJEQTOKI6efOpKSgS9sVQ4h2eYg
TLSH
T144D11327327B13023C7E2508929597264B4179B73029A52B3BBD44B24E37E245EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 475a28c4c7604b8cf1dbff3883187ad0c130dc53deadf987dcab4de659018283
MD5 d2d76d3dceed1c3d90de893920a99dd6
SHA1 5a0101124afd260fc81364e50ff38f04e9ecc8cd
SHA512 eba7c43b1e14289579e0f0af189df88a7e56b7a7d26421ec93066b6985de278ff50565d7bf52f66491aa4062e60b87fab48bdf046b43edac2c899123480dcaca
SSDEEP 192:zeEe8NXUJQK2U7nvQmiU1MnAtF8Unv0qofO/skoBL+VX0F0YqqYwCY0WydI:zS8NXUJUuxoiFHnsxO/MKVX0jbjaI
TLSH
T19B423A79ACB89C3359A6A545F88733539FF810B7DA892F84E5C89F0D009B69D330781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 91fc2ef04896390da240c4792b762f0158bb15f595f53d7a8a43acd69443c548
MD5 f99604615e247d1b57a8743b35b26e0e
SHA1 b388aa433a23079bf3c6894d5b35b1c29d4183a0
SHA512 0da7e9d3fda3b3d70405b4efe2a27d228c9ee7c1a62782b2df65b6cf1bccfb70fc00a6afef93e06a0aa4b767c4882087ef50168b7d933ad31c388fea422994bd
SSDEEP 192:yqEe8NXUAQK2U7nvQmiU1MnNtONnv0qofO/skoBL+VX0FzYqqYwCY0WydI:yO8NXUAUuxoTEnsxO/MKVX0CbjaI
TLSH
T1E9422A796CB89C3359A6A545F88333539FF810B7DA892F94E6C89F0D008B69C2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8c9d43031448b8e92e631c0cfa274cf80293c41a5a7ba72f831049e3734d2bb6
MD5 854e45227bf88c954144e43712dd0d26
SHA1 6e8b0368025ccda7a605dabb65c08741fddca708
SHA512 cd5463e72d5d6613fde582f0cda8bba0c681150bcdeeca05c4c7eb9fa2adf57b5f804b9bebe6668d641ab6051460645bf3f4aaefb5ee85828c704b26aa7097ae
SSDEEP 192:yqEe8NXU/QK2U7nvQmiU1Mn0ttanv0qofO/skoBL+VX0FzYqqYwCY0WydI:yO8NXU/UuxoGAnsxO/MKVX0CbjaI
TLSH
T1E9423B796CB89C335AA6A545F84333539FF810B7DA892F94E6D89F0D008B69C330B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 624dd7f46a170a61da088db355449a6c33e5ca95ced2553b7919f0c4343d1b32
MD5 34a605ac421db9713ab2849ee0321c00
SHA1 eab94b0ee4e77938e2b13219bdffd6800745307d
SHA512 49507e491ac8e89755625826ef78e171a6e34dcd3e4b53bae7fc6475ac1efa5b0f7031c4091fe17fc2b20fe8cccda8cab24659b369551da594348b5f6d74ae93
SSDEEP 384:yjtNnNnb9L8NXU/UuxoXInsxO/MKVX0Cb/SA+jXaRnPNSw:QjZbpMfQsxO0I0Cb/SAt1NSw
TLSH
T10C926C3969B89D375AA2A504F84B33539FBC14F789853ED4E6DC9F0E01DB68C2707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b67893be1253e751c8eef8ca4dc9d2d8f1fa84fa757f2cddf1eddee2b222caf0
MD5 477292c73357c1a70ec7cde7fae3a3e6
SHA1 ccd35b744d3dee1e8ce99ec1e5cc8ce1ab8c5efc
SHA512 75b38fd2a4d27c15bdc94bc10e592259a26f9ffa877b11ec1feb238d95c262d7410ba8eff47202ab5a23360e2884f6f70e9603afef9d4fa180be89bebcd32ae5
SSDEEP 384:yZtNnNnb9L8NXU/Uuxoa+nsxO/MKVX0Kb/SA+jXaRnPNSw:SjZbpMCysxO0I0Kb/SAt1NSw
TLSH
T1D8926C3969B89D375AA2A504F84B33539FBC14F789943ED4E6DC9F0E01DB68C2707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ad66078f78963909f28fb1d4693a38e2feb9cb92346d016c5340d96c529c675
MD5 b128a011433a61ca3120f819174a4ae4
SHA1 ed6bb3484bdc899653c2681860e435fdb8567c47
SHA512 3c595899495e81f8084e6837c92f1f1cfa68edeb5b2ba7184e2678032dcd2b19841f7fd691132225aeb0a861dbc74125408aef161bea8ec04be0be4f14e75013
SSDEEP 192:BGNy6P2UOcQmiUytIUyqGv0qofO/sKwSniU6:BGNy6eXsyIxqGsxO/biU6
TLSH
T1C102D839AD682C779EA2AE45F98777178FE8106BEA962F80D5D41F0C00DB65C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f972829fe4be87814d6593bef55251730cca2333f5d6531b87c133ddb4dfea5e
MD5 96f061e2f409ae7c1de4b4f34b4ec0e3
SHA1 8f272ec2561f7c8c2aa6969788f732fe949dabf0
SHA512 661647e776275a26578973a05c5b2bf7f8f482c224676d4ec1a6615fee59265a7f4e1b6f6accc37e709640a205aacf2494fa8b750350809f45c1dd14bdf35292
SSDEEP 384:ykiF1tNnNnb9a8NM8TUNTUlIl/UuxoAAtDfYHsxO/MKVX0Kb/SA+jXaRnPNSw:MF1jZbIZwgao7HsxO0I0Kb/SAt1NSw
TLSH
T1CEB23A3AE9A4DE3BADE35785F6077396DFE401A389882DD4EAC85E0D00976DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8a686fae640746d2c2c6f60076b9a3c244c257bc7270aa9034908b14884c92c5
MD5 dceea84624f9eaaa21a3de8f4e23b578
SHA1 4836d067aae15239df087d26660775b0976d0199
SHA512 26a74abd07cba8be0c290285bd53b4b4246aed0c16a783f932b8fddf6388dec6d9e8e77b84b49f3abd1c2cdb2540bd3433970977cbf220b14e275fffb3824c61
SSDEEP 384:ykiF1tNnNnb9L8NM8TUNTUlIl/UuxoRAtDfYHsxO/MKVX0Kb/SA+jXaRnPNSw:MF1jZbpZwgaJ7HsxO0I0Kb/SAt1NSw
TLSH
T16BB23A3AE9A4DE3BADE25785F6077397DFE401E389882DD4EAC85E0D009769D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9aef1f54539c9e3a11c50dc6fbc26d4e1d0a3e577621820ca56532a1509eecf
MD5 07c9449534578cd6a0501ce143224daa
SHA1 f46148bb42e34e09949f5266bb1576435c809ae6
SHA512 353be86a9840935cbdcbe14402e6341ddcf3543233aadefee7381fb5464d02a644e448334728fac5b2c6555af0dfd110ed75f326d5954787b1823aa3cc3ffa79
SSDEEP 192:BGNd6P2U7QmiUynnEy0Gv0qofO/skoBL+VX0h0BqqYwU6:BGNd6eWsh0GsxO/MKVX0mbU6
TLSH
T1F812D779A9A89C371EA6A545F88333579EE820B7ED462F84E1D45F0D00DBA4C374B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 87102b9e07b19cec1a18a448a16b5572a427daae8daaa697990bd6c61970e56e
MD5 f95a086aaa4c8a774497b1fe7929bdac
SHA1 cee7b7c6d40ef90341ca99341a542d2d78e7e959
SHA512 697d3eec05f9445d6073cde57b4679e9072a7c9df8c0f10b1351471b67f0b3aa46a5d4dbf8147585efa2d37f7cca0c23ee47d07f1203294eadcf601593c1ef25
SSDEEP 192:zej8NXUJQK2U7n8QmiU1MnjtLZnv0qofO/skoBL+VX0F0YqqYwCY0WydI:zM8NXUJUuMopVnsxO/MKVX0jbjaI
TLSH
T102422A79ACB89C3359A6A545F88733578FF810B7DA892F94E5C89F0D009B69D230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddb28627-6669-4e26-93ff-f8efadaa68fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ddb28627-6669-4e26-93ff-f8efadaa68fb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2d80e18c-80ff-4b44-b27b-f750672326ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\2d80e18c-80ff-4b44-b27b-f750672326ac.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8ed396f9-43b5-468c-9d2d-5bb0fa151f12.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ed396f9-43b5-468c-9d2d-5bb0fa151f12.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Relax_3.MP3

Path C:\Users\Admin\AppData\Local\Temp\Relax_3.MP3
Size 12.8MB
SHA256 e335b5ad7b63300eda9ccbaa71fcad0e45f95a3cb9833d11e5679ec66ae9047f
MD5 c7089dae0db5cbd499d0106dc5b7f0ba
SHA1 73e17b78c158d7f53151dd7ef1b960362750ac46
SHA512 24b1d27bfcd37b01ce5d8ddbf639c0b1133790b1e4f63d8f63293bfdfa729158ae511b2da647d2b64fd8d7cfb8244b58218abaa0c60cd3c6cc22db76adb81bf9
SSDEEP 393216:pELLSH49mztq0eP+NRqp+mLPrv0NddtqjCfOo:qCYckXhzsNddyS
TLSH
T13DD6334FCB001D6FF45947F995C74AA0DA2B2F1DA609B0DBDA25B70070F7221B7E2A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

889aa400-f4c5-4559-8105-5153e17747fb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_1062127562\889aa400-f4c5-4559-8105-5153e17747fb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_1062127562\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-17-0x0000000003D80000-0x0000000003D90000-memory.dmp

Download

memory/1136-16-0x0000000003D80000-0x0000000003D90000-memory.dmp

Download

memory/1136-18-0x0000000003D80000-0x0000000003D90000-memory.dmp

Download

memory/1136-15-0x0000000003D80000-0x0000000003D90000-memory.dmp

Download

memory/1136-19-0x0000000003D80000-0x0000000003D90000-memory.dmp

Download

memory/1984-38-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-111-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-41-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-85-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/1984-86-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-87-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-89-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-91-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-96-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-95-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-94-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-93-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-92-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-90-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-88-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-97-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-98-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-102-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-101-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-100-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-99-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-109-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-108-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-107-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-106-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-105-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-104-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-103-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-110-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/1984-40-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-112-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-113-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-42-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-43-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-44-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-45-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-39-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-34-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-35-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-36-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-37-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-20-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/1984-33-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-30-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-31-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-32-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-23-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-24-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-25-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-27-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-28-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-26-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1984-22-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/1984-21-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2024-12-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

Download

memory/2024-13-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

Download

memory/2024-9-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

Download

memory/2024-10-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

Download

memory/2024-11-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads