hxxp://trouble-shoot[.]it[.]com/processor[.]ps1

Analysis

user interaction
yes
max time kernel
241s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://trouble-shoot.it.com/processor.ps1
Sample260718-ewppbabs9x

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288218677884606"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BECB7066-3001-4078-996F-3A957D96FE8A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
2472	notepad.exe
3320	NOTEPAD.EXE
8884	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 888	3040	msedge.exe	88
PID 3040 wrote to memory of 4908	3040	msedge.exe	90
PID 3040 wrote to memory of 3756	3040	msedge.exe	91
PID 3040 wrote to memory of 3756	3040	msedge.exe	91
PID 3040 wrote to memory of 3960	3040	msedge.exe	92
PID 3040 wrote to memory of 3756	3040	msedge.exe	91
PID 3040 wrote to memory of 3960	3040	msedge.exe	92
PID 3040 wrote to memory of 3404	3040	msedge.exe	94
PID 3040 wrote to memory of 3404	3040	msedge.exe	94
PID 3040 wrote to memory of 3404	3040	msedge.exe	94
PID 3040 wrote to memory of 2348	3040	msedge.exe	93
PID 3040 wrote to memory of 2348	3040	msedge.exe	93
PID 3040 wrote to memory of 2348	3040	msedge.exe	93
PID 3040 wrote to memory of 4792	3040	msedge.exe	95
PID 3040 wrote to memory of 3952	3040	msedge.exe	96
PID 3040 wrote to memory of 4792	3040	msedge.exe	95
PID 3040 wrote to memory of 4792	3040	msedge.exe	95
PID 3040 wrote to memory of 3952	3040	msedge.exe	96
PID 3040 wrote to memory of 3952	3040	msedge.exe	96
PID 3040 wrote to memory of 3864	3040	msedge.exe	99
PID 3040 wrote to memory of 3956	3040	msedge.exe	100
PID 3040 wrote to memory of 3864	3040	msedge.exe	99
PID 3040 wrote to memory of 3956	3040	msedge.exe	100
PID 3040 wrote to memory of 3392	3040	msedge.exe	101
PID 3040 wrote to memory of 3392	3040	msedge.exe	101
PID 3040 wrote to memory of 4068	3040	msedge.exe	102
PID 3040 wrote to memory of 4068	3040	msedge.exe	102
PID 3040 wrote to memory of 4068	3040	msedge.exe	102
PID 3040 wrote to memory of 1656	3040	msedge.exe	103
PID 3040 wrote to memory of 536	3040	msedge.exe	105
PID 3040 wrote to memory of 2472	3040	msedge.exe	107
PID 3040 wrote to memory of 4924	3040	msedge.exe	114
PID 3040 wrote to memory of 4580	3040	msedge.exe	115
PID 3040 wrote to memory of 3792	3040	msedge.exe	116
PID 3040 wrote to memory of 1944	3040	msedge.exe	119
PID 3040 wrote to memory of 1944	3040	msedge.exe	119
PID 3040 wrote to memory of 4704	3040	msedge.exe	120
PID 3040 wrote to memory of 4704	3040	msedge.exe	120
PID 3040 wrote to memory of 4704	3040	msedge.exe	120
PID 3040 wrote to memory of 4748	3040	msedge.exe	121
PID 3040 wrote to memory of 4748	3040	msedge.exe	121
PID 3040 wrote to memory of 4748	3040	msedge.exe	121
PID 3040 wrote to memory of 3872	3040	msedge.exe	122
PID 3040 wrote to memory of 3872	3040	msedge.exe	122
PID 3040 wrote to memory of 3872	3040	msedge.exe	122
PID 3040 wrote to memory of 2624	3040	msedge.exe	123
PID 3040 wrote to memory of 2624	3040	msedge.exe	123
PID 3040 wrote to memory of 2624	3040	msedge.exe	123
PID 3040 wrote to memory of 688	3040	msedge.exe	124
PID 3040 wrote to memory of 688	3040	msedge.exe	124
PID 3040 wrote to memory of 688	3040	msedge.exe	124
PID 3040 wrote to memory of 212	3040	msedge.exe	125
PID 3040 wrote to memory of 3468	3040	msedge.exe	128
PID 3040 wrote to memory of 3468	3040	msedge.exe	128
PID 3040 wrote to memory of 3468	3040	msedge.exe	128
PID 3876 wrote to memory of 3320	3876	OpenWith.exe	129
PID 3040 wrote to memory of 3264	3040	msedge.exe	130
PID 3040 wrote to memory of 3264	3040	msedge.exe	130
PID 3040 wrote to memory of 3208	3040	msedge.exe	131
PID 3040 wrote to memory of 3208	3040	msedge.exe	131
PID 3040 wrote to memory of 3208	3040	msedge.exe	131
PID 3040 wrote to memory of 992	3040	msedge.exe	132
PID 3040 wrote to memory of 992	3040	msedge.exe	132
PID 3040 wrote to memory of 992	3040	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://trouble-shoot.it.com/processor.ps1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffef3b2c188,0x7ffef3b2c194,0x7ffef3b2c1a0
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,8537330887151229814,15988136571857309819,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,4062322553708538613,16199214043765507576,262144 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,16701704247327126811,9765632715595556015,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,10366819775618459327,18289185158210104353,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5246764772870966439,16140252788555532594,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,3669957129211444389,15657153427841474215,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,12234889795877430848,9756131750087381948,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14271335720025419616,12182938038798266002,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12188245058019702687,10683770941026440969,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,2675383275679107808,5914250097705518957,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5752,i,12101248595417494455,11848090728716763977,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15066050389704197846,6012375945417219344,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,9058482398562995623,11616899922714492058,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,9058482398562995623,11616899922714492058,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:536
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\processor.ps1"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,2238479468451730078,312397773333670040,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,5222202793225160226,4412452817852026721,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,7407403143825963206,12293915029346023783,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,804942784801566598,8029305913471087496,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5400,i,16156536247355426409,2034423968566814473,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5872,i,9456424840987784751,3358535995068247041,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5264,i,16951879683493310576,1600713960563984557,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6960,i,15596535864004226084,2337615063537517107,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4308,i,2928504554915300594,12864516645473427764,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,7287213916025415555,15606280476892000508,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7076,i,5464261766611103927,16636766923210668026,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,10340289192737099987,14178741847711838100,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7436,i,5866855087597733942,10148003287982697375,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6976,i,3112281228049610515,9575759401859938566,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6948,i,7202587352131909587,1745229937960681414,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8120,i,13304378334237644641,16590532983077704228,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7720,i,13968039861674007608,2247936505730261489,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4376,i,10571998139592356078,15471274673959889806,262144 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3512,i,11054034844703034858,2092397429659388172,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7888,i,16155809636706565622,11170622158183765184,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6416,i,7138983437105546585,8801204963025935388,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=3976,i,7636097951760402807,11937754001796356490,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5128,i,900417473753358790,17816406630552858429,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=1552,i,13771077487508912467,13828816285711907562,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8248,i,1314169378366742402,12811896099477369709,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8432,i,15267359431508990874,11293803445282883228,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8700,i,14281949264578013064,1232510692782423584,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8820,i,1333190785903347169,9835231653587297159,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9004,i,3985406507373309355,7076040309995521531,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9032,i,13807299959041456536,4962800206902995031,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6128,i,16612786836128146485,13612226712667388450,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8784,i,16497619731514299548,2707547436852845830,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9056,i,7035331472295501517,7696432131485081010,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8684,i,12374169744601551753,8239162708357134889,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9024,i,13514262941808506728,3008266577076938730,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9516,i,3430669395071845367,13413396835915724663,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9664,i,12043983995943384147,10548374683196970615,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9540 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9860,i,5663800497787486111,15914726610763230589,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=9816 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9688,i,16658500420096492855,1268265437664185038,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10020 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10000,i,8910471035570605937,8384246608307901192,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10180,i,15861396722290288985,5288201769119263480,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10268 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10320,i,17770516161526006116,15971175671789934068,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10332,i,10752793480423929428,2217922842497794350,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10440 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10708,i,6906934893126779905,14256240192174502100,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10720 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10624,i,14449290617900026254,13178198598701975092,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10928 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=11024,i,12404998801674005218,15607799941194053303,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11036 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10736,i,14468066077442512575,9385702468864015996,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9056,i,4680530682491938228,1981229274376719941,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11304 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11432,i,17758701785667911403,14313150353263439479,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11444 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8268,i,18128810445014630242,16585856630192620059,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11596 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10856,i,7069620807311159560,1295789154842753308,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11328 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10848,i,15588348123475325090,13393350236589811886,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11716 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11872,i,17761774889289030813,14978211846633225042,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11876 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12024,i,11455551062019659132,5409885483160906168,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=11920 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=12156,i,13114917006445029085,17338034990996314312,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12140 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=12172,i,6687462293991336218,9421527498543191600,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12260 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=12192,i,11886441628917224596,14710450508027412441,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12272 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=12212,i,17987231297347950940,3117986345380901729,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12328 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=12232,i,17119755618217474522,16537760332850831456,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12388 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=12252,i,10647889191817261725,17840986912210795548,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12392 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=12424,i,6311813238687873914,16877408232892003494,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12980 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=13024,i,2049071856967171783,10113003266247383299,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13112 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=13280,i,9261680708068904455,3695691670002335120,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13244 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=13440,i,11463703229184754976,13340903992453555226,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13444 /prefetch:1
  2⤵
  PID:6148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=13600,i,15088261297910509920,8572157011009338648,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13468 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=13716,i,11225126449177723040,13945558754602487423,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13748 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=13876,i,13657306394065935285,14828430434245619612,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13936 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=13904,i,4007162060253242517,441165696892922232,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13992 /prefetch:1
  2⤵
  PID:6184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=13924,i,17242004582770894688,12492118925153063416,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13996 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=14224,i,5513867404987991008,13545405241159316398,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14332 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=14468,i,1137546587996618443,13069138336331057253,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14484 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=14612,i,11992928101120081772,13185763257347950544,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14616 /prefetch:1
  2⤵
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=14680,i,15776032740470576857,5630920551221006945,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14708 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=14932,i,6616167067956376843,12443512489957993059,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14944 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=15068,i,18245329922692849002,17782492566733072536,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14636 /prefetch:1
  2⤵
  PID:6252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=15196,i,16804591645466634773,18275214033729501882,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15208 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=13716,i,17984878232618225918,16043710635362134278,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15380 /prefetch:1
  2⤵
  PID:7376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=13604,i,10762287734083256967,659185361255353921,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=16024 /prefetch:1
  2⤵
  PID:7568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=12464,i,15491259473790967453,18419178315416022465,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15068 /prefetch:1
  2⤵
  PID:7612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=15612,i,12392603033549985643,11822631998628152617,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=16136 /prefetch:1
  2⤵
  PID:7620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=16184,i,13000615613871665768,13352724007120145297,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=16268 /prefetch:1
  2⤵
  PID:7628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=16460,i,14678467825446698396,4415918107482131040,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=16440 /prefetch:1
  2⤵
  PID:7668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=15440,i,6811874494049377861,406598336707852783,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15556 /prefetch:1
  2⤵
  PID:7860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=16700,i,3826046733865693607,6299082353613106092,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14664 /prefetch:1
  2⤵
  PID:7868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=12224,i,7310467409503544258,8731045583578089472,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13284 /prefetch:1
  2⤵
  PID:8056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=12164,i,3057309697713229762,12539846978133290649,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=16896 /prefetch:1
  2⤵
  PID:8132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=13248,i,6942041179634093538,4164939807836852714,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17048 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=14500,i,18421374842085293528,12480912922020543344,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14608 /prefetch:1
  2⤵
  PID:8020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=17160,i,141808682007725415,4791038311879900279,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13944 /prefetch:1
  2⤵
  PID:8240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=17292,i,17049159580930034839,2207086575327950556,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17288 /prefetch:1
  2⤵
  PID:8252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=13888,i,8541960512362684085,4493852242238486075,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17460 /prefetch:1
  2⤵
  PID:8360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=17584,i,16927208781425026307,9364392037466177265,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17600 /prefetch:1
  2⤵
  PID:8412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=17732,i,16602292611840255727,5934224255998789152,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17748 /prefetch:1
  2⤵
  PID:8420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=17136,i,14797603567474226075,13901227139914743247,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17936 /prefetch:1
  2⤵
  PID:8524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=18044,i,7635265204345933620,5743234656985779842,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18040 /prefetch:1
  2⤵
  PID:8532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=18068,i,13278722153605609270,7604821852879939906,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18080 /prefetch:1
  2⤵
  PID:8656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=18320,i,12501663992921936817,18235603952958282451,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18332 /prefetch:1
  2⤵
  PID:8664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=18500,i,4333580899716293348,10891160173619652753,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18516 /prefetch:1
  2⤵
  PID:8772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=18468,i,10012878183441813020,524723629266129101,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
  2⤵
  PID:8920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=18636,i,13078034183047705955,444335269103623055,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:8980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=8988,i,14675973306457958916,8524391727141809669,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18756 /prefetch:1
  2⤵
  PID:9036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=18896,i,10459858651704272968,11283217848158408156,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:9092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=18904,i,7701379990093073367,11976238399819395680,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18912 /prefetch:1
  2⤵
  PID:9100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=18988,i,15034845173799024413,16682296375451757051,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=19004 /prefetch:1
  2⤵
  PID:9212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=18776,i,2193491118881083440,17463629092771926742,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18968 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=19176,i,278219658021084019,7919987934228664356,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=19140 /prefetch:1
  2⤵
  PID:8844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=8592,i,7909537699046242172,12886366629955908201,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=13948,i,11114567970080329236,4256913107112822899,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14976 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=16552,i,9521679544655114108,16358767894353449938,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=13600 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=15984,i,10358305558419256881,10265639638034377739,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=19156 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=9272,i,8946742421642557430,6940174917439739556,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17588 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=16724,i,13802413922947907132,16672154443941380799,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18364 /prefetch:1
  2⤵
  PID:7104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=8552,i,9926272247543797481,435029751916505269,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=18332,i,13081604550158133927,1901254959454134916,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16744,i,11025710183918344522,18264003503551353770,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=16792 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18232,i,2927625041603057679,9881491508886166775,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17368 /prefetch:8
  2⤵
  PID:9000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=17084,i,13343575744924276999,7197595030171032669,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15468 /prefetch:8
  2⤵
  PID:9024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18320,i,7645063190535169812,16152853186411860147,524288 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:8
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --metrics-shmem-handle=4052,i,8573739507186821635,13906680188761000709,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:1
  2⤵
  PID:6252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=4068,i,15229365054572346153,7497656297610006414,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=18400,i,18148730775500452324,12400242128788037658,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=12688,i,7948826185019020866,3910972750302339413,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:6960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=18284,i,11846143646347510942,17314184975839828915,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18248 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=12424,i,16708138115679119925,15796306068849001998,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18052 /prefetch:1
  2⤵
  PID:7920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=19144,i,720895114638749236,13059606427647567355,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18300 /prefetch:1
  2⤵
  PID:6816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --metrics-shmem-handle=19128,i,2984174830654613928,2959982660985656798,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17540 /prefetch:1
  2⤵
  PID:7224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --always-read-main-dll --metrics-shmem-handle=14744,i,130509467887791610,3869837823609999904,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17520 /prefetch:1
  2⤵
  PID:7452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --metrics-shmem-handle=17192,i,11854994611677265716,6679851709868275181,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17596 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --always-read-main-dll --metrics-shmem-handle=17252,i,2624646265139209667,18349956532801144546,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=17212 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --metrics-shmem-handle=15404,i,10434929880111552895,10225514032630051034,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=18200 /prefetch:1
  2⤵
  PID:6364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --always-read-main-dll --metrics-shmem-handle=15668,i,2214953524299010610,14343359406112478639,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15640 /prefetch:1
  2⤵
  PID:7056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --always-read-main-dll --metrics-shmem-handle=14932,i,2063949983283980123,1104450701139787156,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=14736 /prefetch:1
  2⤵
  PID:7928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --always-read-main-dll --metrics-shmem-handle=14076,i,8757971868869810416,6919757705994539616,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=12540 /prefetch:1
  2⤵
  PID:8008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --always-read-main-dll --metrics-shmem-handle=15640,i,6328814135743060510,2262003364000438152,2097152 --field-trial-handle=2424,i,1785278500251643094,7620046180665608398,262144 --variations-seed-version --mojo-platform-channel-handle=15540 /prefetch:1
  2⤵
  PID:8484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\system.b64
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3320

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\aaa.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:8884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 402KB
SHA256 69b79e465023575e6e6f093be9ba6f85c363ce90a280acd3c7b2c7d6f204f965
MD5 98c6491208eeb296df8b58318f15eab7
SHA1 93994960c8dbcf9e8d450594e6906ea4e6291f87
SHA512 8e1b8698d6bda7974475a6e04de6df8b99f982cf7818b24f6992d4269031b86b06289130f55e9850652dcb439aecfb7f7a3dcc3a3524994f83d52a3feeac232a
SSDEEP 6144:8wZ9mCDGBf/QBXfmnr936pXTH1A4nnOIithRTP1UEHdxsNTV0GU7iE:BHmCDUf/QBPahKZp/nXi7fvd+OGUT
TLSH
T12D942349776709F0486975AB0BDC93EBFCA1934246F43D9C32E647C949603CE206FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 67KB
SHA256 960e7baf8bbba1197cd9aef093148b65cb2a6402dab34683c78e27b9650afe34
MD5 3c35fab00df625d1ee5da7d87cf9d042
SHA1 ff2c71ae25a5a6c74d49b7048bfa89e2b4cffaf0
SHA512 cd68c44d2df728d2c63e81bb1a6faf4dd181f62b7147faa3b2fff3a499d2a5e0c779c885f959606f0dc8e7eca99e20028d10bd316232c289d77d21d5bcfefa84
SSDEEP 768:HZcM10gssesnsAqsrQpz2tbfQDbCdTkhcwXk3mvIydcKTOl6uIBwxhY1i8vZANVl:5p0gnDn1JspOtocwXZIydcpeYhgZoD
TLSH
T1F4631241E20472F3E65C995D3B7B40314291ADB9F8D8DDE878F00AF906EA9DD19C4289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 78KB
SHA256 6b1362e379d35766d00b5db728c5213ced298094da1ca879b45c8c7672ee125a
MD5 3d006056480e3e7355f88ba493afe8d9
SHA1 d32a63f84180a91b3492518c8d206863b7ea561d
SHA512 e0428fa34e178b34745f3e346866c3ca7a28501b6cfd61e296473e8223de0fde1e160422436d5dafab74457447b0113c6ff9a82e95ed148f5fe78354fe7420ec
SSDEEP 1536:srRVaEXpp2yU9iUpHfhmcl9PP6t5fuWtxSbGvpH0jJcWQIvCQT+knI5mAa:IHFXp8H931pmscRhhH0juBnF5m7
TLSH
T19D7312BE9D6DEA109DEBB88A7D15E95036B507EC16283A0D67C0EB233D58B743001DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 19KB
SHA256 b9e910102d058a696ccfcc1af565d3844c952c7e2127915ee2953f66839a9555
MD5 9f98b25682d26512e43c53b3ab379849
SHA1 241687b6aba85f978728113da6a9831378bd6320
SHA512 9cdd2d1b0d782879d8e089292d6b7e44efc176ae733e0cd223a1815636eb7776afdfef1d46a63121a1cddf261aa1af5741138e5026d8abaa1586f32507068e80
SSDEEP 384:720rn9jqnI9cpR2kDPi+Ck9Zl+jog912SHX6Xr6V3FFBH/nRLQ5wDhxCmH4I1:nrclta+Ck9DoogP36XmZXBZPDbBH4Y
TLSH
T16892C0A09992C88ECD36F4271E5EE9C3595CE4917E3A0BBB07D26D5B084164A7CB21CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 59KB
SHA256 ab6ce8ff54d1f01c22dddf7dc492329d8ee36fda895288fcf5d111847f95b6fb
MD5 aa060b8f7eac87b383d031c5e0fcf85a
SHA1 622b5c4479702b776c879b4e837e45c1aba0bb2f
SHA512 13a7ae181bc7a20d8bcd0749af9283099ec4e203185fe226bc349b7ea8f60a35d7c6dc52c75bea86a94468c4f3677c89b48472a3ed0f4764a6f899b44163d84a
SSDEEP 1536:Cku8cjkJcFRVdtrDBg/IMAlV1W4609HlHxtk6v3LVV+4:CpxTtrDBwAlHW46CP207X+4
TLSH
T1D853F20BE27CC9639D18546797146BFF3972B2221A1BB46ACCB877DC0C451E14FDAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 70KB
SHA256 fb687d71a9090fd9b633c3653a29fd3ff5a0232219faf486fc7bef2442a2b0f8
MD5 457a06fdf8d4e3d90fe5d3f6666ad04c
SHA1 3f0907e5739b107188d38c2547a9bca8ba8c969f
SHA512 1333d720540ee69790ba13c32311775888e8018e5eb8c4af973133a68e10fb934465d98ff007bb79d40f31480bbb57dac100de1d427b6700b4379aeb69980197
SSDEEP 1536:Qdq4rH3xSG4yuk6NTmRH2Ma2mxKie56ckEcHhg8FimgmziZh6YoVLFPjlC/FQra:N4reyB6FmN8KqckEymWG/hFoLPjhra
TLSH
T1806312DC7216EB862B148A27F4E615C96B740947E2C9D9CA0D1D33EE1818E3F7FE2160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
Size 75KB
SHA256 4ef2a83a3eec58815f31974c22f79ddb50ea57d7baaa36fb608d27a74ac36924
MD5 5e29dc1f09f1b40acbff500b8afb570e
SHA1 d57ae6dc18717ceca5711208cfe0697863d6c464
SHA512 24ca182b59adfa7aba83bc57f90afd226547700e1b40c5819d1ff76dd98761c3ff2ce485abe6485c6a818668da92d3ad8fb5369df6ea03d7ac1e45f6607c65a6
SSDEEP 1536:FMKqDWMrsVUERVM5FAd/fEYv+zrw7PA7KEOhJICHU562FFhQXzkb0s:Fjqy2sVUELdbEUPIK1LHh2XhaYbX
TLSH
T13B73121FBF8B2C2CA95F85D98C2BC9DF8684071EDE5BE599F4D760A70182113AB1503D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f2
Size 21KB
SHA256 d67282a8a5546dba41ce7fee7d8f11dae08c254627447439693ff5377c6e08ea
MD5 2987a58a86ff727b6748b199769c9fdc
SHA1 b0c83c9f6b0471ad6c4fac15c0b4f11ebd037059
SHA512 e6fa127008d74ab8eef6c4d3dbae249c182fa58baa423fa002a3141b9680ffacf0c21b0e98c52dcb43612133e8bc7fb889e647578e8eeff25c2785647496dd64
SSDEEP 384:mg2Dk3V+uIfGNBIjZqoPvmVk8QUZOqeahCA/s9YToT3yOTl3QEgIfiUyO4C5eZyM:pz3WfGnDoWVJQiOqeeCX9EoryOxhfiUc
TLSH
T1C2A2E1A0CBBE85DB640171917532884B86AC530FF58A9CD6E601677E07339BA3C87576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f4
Size 73KB
SHA256 b487c29b4cbf060f59545b5633614689cf0afb4dc68876e94bf6a57f4e6189ea
MD5 d1c56c536ffa6748fafb5b97aabca403
SHA1 f3ebe83bdb442bbd705b7986ec7913a55c595e38
SHA512 3801d5b7a1a4086b0bbae9d5eb8a39ea2aeae0c2d90f5cd9b9b0c9d583b6bf9b28041bf8639dba44c250c78c04e507180f054f95c70cec90c82c33423556c627
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwgGTipUWMKZ:mj1h9rIHApCReO9vWR+7GepUi
TLSH
T1C27302C63DAC9C1E07FA53DA4BD588812D259364CFB519086FBC0A18FFB541713AE61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 fbc05c566629752d44278e4dee93f09d87ff06300b19c3d94b579b309f0dcf41
MD5 e9a2004ee095243a31fd99fdc0c71589
SHA1 cd8672d2f44dc8ee7f2284fcd4bfd96dcc769976
SHA512 f79838880f81835ee5f727dfb3b3231c0e039e729b6b1eae40fa05cb94d5e8348547d7fa0b67401004d434b67bc9365a790cccfc2993e6442de6150e6d506a8a
SSDEEP 192:/87pkH2maI8Hgb4QnQyqEmSwQQs57fenMxop7u2Why:+VmQOnQkwaAneoKy
TLSH
T1392222677987AE33CF158472CCD43AC170BCAC694C873E16DE40597EA50B7EAA386468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 d61bdee4379320ca723ee627bd511f6851d23cf5f51f16c4b0e597c55dceb90c
MD5 7e6e25e069994c9fb28c544183882586
SHA1 ceeb9c371f18903c017fda36201e31682d42e443
SHA512 33715f5fd45cff51ad173ae4f43318007a51c63cbcbe2e0b1024ab2c93f667919bb83fe3c6cae74b7e64ecc748c5da0d6401a626a6765b4f2d54a20a7297e2c6
SSDEEP 96:Hps1TijkBnwpJLIaT8zE7gb+dBeGBD0Xtt1uhS4jnuMxjq1FzcMD:2wjkBoIaT8zmgs1uXttIsAuMxjuFzt
TLSH
T170F1FD6371897F72CB144176CCD53B80B5BCEC680CC73E2AC84059BEB51BBE662CA894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 43ac3e0a2a661033b90c09b16982eaafa3f0831bbee6e1cb20ee4697e60828b7
MD5 197de59102cb0e2ba465ea6618447771
SHA1 cef9c018dcfff2ea3b937fa676cce1c8dac8f8a4
SHA512 a5ab7ac7669b5b58f551ee261ad57843bf97a09cc7333c87889dee10d86760798e2be8a19b5b22b2bf375c01724b283a97f6e2df15c6c4c95fe503e9b3b3e497
SSDEEP 192:IrHkvXHuZ+txChQISdH7whFO/z282lmyt5K5OO+sh/C7fR:o4AhQv7OO/byt52gKCR
TLSH
T1D83244677497AE33CF148073CCD43AC074BCAC794D873E16DA00897EA51B7EAA386468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c80266009790d1f1febf3aab8f3f242c49522539cc0cfe2b16e643aa4be9c7cd
MD5 5592609bf773a96203b35744fb622539
SHA1 edcc2c53ff9645b9375ecfc3793808af7cb78839
SHA512 4a8505a37608a08429f8e7c00f2efc43e44f2c763f20834a56e63b4b49c3667ca01098069bbe42501d1a9884c9456fcb2f3c00d2ef565e1cfb3237d0b8179b54
TLSH
T13671193726424952D34021B1E8A91B40F6BDCCAD8DCB7E6A1E904DFEF919B47B306CC9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bdae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bdae.TMP
Size 3KB
SHA256 f4796d38f09ff3f9b360dd3a7d9f84cdc6fb036e6455b89ad8e0ad52b5ea4a9a
MD5 a7b6d21bb826702e77b1b02bb38e2352
SHA1 4ca3903e2bbfb058f8406a9ac0ff993f99ceb5b8
SHA512 04705c5fe9c72f5a27527201ca8fd169c0f8456d0456d9dca0f43a40ff0c3e2825cc55d21430abd15a1f535c832fa623fbfde7539dfe5f149954a2c6a1dee82f
TLSH
T1A071293726424952D34020B1E8A91B40F6BDCC9D8DCB7E6A1D904DFEF919747B306CC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 63KB
SHA256 aaf503aeb49e70dba196b7e8a469b467d3673de5c77e2fb6cdaa280602645e2e
MD5 2ed6c4feeccd579794a475ad81e1724c
SHA1 3ab22df3766f82f4a2f6411429ab87ad69fa48e2
SHA512 bd1445f4618db12a0b4a3a4d987f3717c3d5dbe8548c11b78ee953a9f14b6af813c69b467e9294c62a8364e0d33d6bc650242c2db1353d2f20b10e2769005fac
SSDEEP 768:TsS75+lyesCOrSgqp0nuxc1v3bU4pw6MHLwJ7My+g6Mf:TaljeWAFt
TLSH
T1A7537DB6C3B08FBD985163F89A242E5ECE2A2A2553BC7815CDD56E07D3F2471C28191F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 8ea0ee03e7da486e302f0cde1e125e9b6697b3cdcb542bfc9a4cef8bb389f8cf
MD5 bc3e9a45f09076789fb95e2c7711addd
SHA1 0b21128a2c24ed0cd97e812035f45da818e9f988
SHA512 85d85b496e7663cf040f7996d183bf2d3c84bd1f5bd75bf90aaa8985a271b9ac272ac03cc50d1141bbf4c02fade95abb100475eff6ce61411fe337cb8dd18d36
SSDEEP 384:DzDqJxTPnVnuHpe4MzAeg1kjUAUkcu5DGs2kv5fr9rViF7rPoCRiArxe5NGkyhgL:65lyesCYg+waoqOJ
TLSH
T1518288B7C3F58F6D994163F89E142F1ECE2A192583AC781AC9D16E07D3E2471D28194B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ab95b803f61144e7edab673e972b8e6125aec15f3b45206fada2a6fed306ffcb
MD5 9539665c9d36f46df7df338b39c724a1
SHA1 5fdf6c02ec20d2b6cc58c78ef8001aa460db072a
SHA512 c6e4d743aa651d7492776b3c8ff95cd07dbafd8cc24a98f42fee41d8ac8269b6faad20dcddf012e9ff861196858880477dfb6d49a2fd2098af4bccfafc5f1073
TLSH
T18411ADF383E1856F8A0116F06A14AE2BDE5C0612431C7D19C5D4FF2B93F3075E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fe30a82630a611d75c40724bc07b29a4a632acb37cbd249b814a24f13e7c8cf0
MD5 4b006bbcce87a7a118cf83a73903e814
SHA1 0ec3286c318abb38bb1f0155479cb3f707951c0f
SHA512 82728bc64d5c982635c0a6084c81508767a389d4af21b0ef33b283206fba54c57b39c1f2e7c532ab06a388806efe2a709a90cf04456cf95580f7a2faca411812
TLSH
T139D0235B52013075557D3E815469BCCFC327013504CAFED514D0655D053289D0507145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4ef1a5903270f20facf259b6c7e7305f2715821ece9e17d810fba58c7a2537cd
MD5 10ec9459328a351c4342d8e5578f97d1
SHA1 5e028672084cfd1b1f2c9f5bd73bd7591f754eae
SHA512 7b676c7932d05da7c486af30cebb2dbc46e7bcba45991a3a6e096c6bac14f969698eebaa6be18f41799aec51cd503e7e96b5b91d518096191e0cd00112a4aee6
TLSH
T161D0226B220230B5A6BC3E92946ABCCFC32B016608CAEED924E069AD05328EC0907144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59b4c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59b4c0.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5417a8c6fa4cebcd2cfa543f6673410e57a4a5987d1d9e685f763aa2b72bde4c
MD5 08eefe1010a1daf472a77746ea9082ac
SHA1 cac60633eedaaae6e5d9fa0f6bd555939fa92b07
SHA512 90092364a909d9c7dd56dc5ced0b9bf9b200b6bf9b9a8b26381a4b365cbfea8bbd590786f0e195fb10697e749849bb7827d960c122ee0bc4af5b0abd05425cac
SSDEEP 192:sxZ/aRNyM/jK1Ml8M9d/fZs3QSBVIdpJHW6+WNGYw8FcIIgrJ:sxZ/ad1d/fZs3lmJHbG09
TLSH
T12342F9166B349977CCDBD209FA557F53D6F51432A2900E44AEFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 117c4f2793b83058510696584e65b0a330cb77df9053f0ec70b0c94e8a9c3e56
MD5 231ac708e7f88d565523555237c57187
SHA1 24cc3c3e61f2520562eac87280813279bd841284
SHA512 66eeb7567682809948046e82ddc043321f5a029c602a45baca85f93a8251972a2ec4ab8c5725d530788412ebd82ef91b08e0c66fdd73bf2f980bea17817ddc2c
SSDEEP 192:sxZ/aRNyM/jK1Ml8M0cB4d/fZsyQmBz/bDkb9xdp4YRCHW6+WN05bQHbw/YIjJRB:sxZ/afsm4d/fZsyhznu9FWHbhs/2PjI5
TLSH
T159820A46A624C977CCDBD60DBD617F53D6F50423DA954E886AFCCA0C04EAAED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 6701714b430a62f8e0242988cb6e7bafdea861895813b90f6bd880cb0de7694f
MD5 05211ad84e2a4a32be5c561135403806
SHA1 f37b08bcf45bba24eb1cd20437e8d747cfd7193b
SHA512 16f979987bd7fda5d5f49b5f9d8f65dd6978b46b9c622bb63ddcda5c9b49a271980b1ff656bbaca814d457275fc7fa511088218b01a7a142efe918100c36c603
SSDEEP 384:sxZ/afq4m4d/fZsyhvKmtQ9FAHbh/zfzxvnI5:sHai4m4d/frhpySHbdNI5
TLSH
T141920A466620C977CCDBD50DBD617F53E6F50463DA950E48AAFCCA0C08EAAED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 926951a51321be7590579e46663d250a9ed37bde02a1f35945cc821e738648b8
MD5 8fc76163c7bc37378faef85223da5f69
SHA1 0b25988892408c39f53a5aa6b2535f104537ab45
SHA512 2e8e8e6a1613ab2e05e2a9a87bfe9e18042061f744e4a2156c774d0e90cc273d00c5fd1fa10732db8fec8ee12ba42f592aab794b959d83310c38adca7ed8d5a3
SSDEEP 384:sxZ/afq+m4d/fZsyh3mtQ9FpHbh7fWxvnI5:sHai+m4d/frhWy7HbBaI5
TLSH
T111820A566620C977CCDBD509BD617F53E6F50423DA950E48AAFCCA0C08EAAFD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f96269afa35166c27ef9e4b3890b697457f42783670a70ec0907358bf73a31e1
MD5 aedbf8003db7141e18c4b8262f7b424b
SHA1 ecf7124d2e62fa2d935924002a97835168d53d92
SHA512 1d0836bad559f9865779999c0cb180bf02e7d9c424872dd6ec73529a2bfd8f982d7f4ba1404be0a030a99625b51e253d6ae934cfaa96d3156820c6ee9d58b21d
SSDEEP 768:WX4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dFrohNcPac:WX4jeXmWvmKLEu1jacPLZQd+UX
TLSH
T1A0D20A3B280CCB7E4F844E5CED26AE976ED801CB6A584D5447FA494C03CB7EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\temp-index
Size 2KB
SHA256 fdd54930e0e8a2a12293fd887ac85a2c67c53bad728b1bbb5117e4543c56f38e
MD5 676ee32a5f6f60fa69540fcb72fd13da
SHA1 e0e17fc8c9b447524dc3244aa357f566fd92fcb2
SHA512 1b3d5e87d68a0a8917a8f810df37e97ce0eb24f6180fc8ad82626eef33d063e95f1c4ab04a942f4ede0ad8e88b52c2787a7a4c301f8316ddce557fa324dac85d
TLSH
T18551BA8E8CCA19D7ED3C217368B714C0377524DD56848B1799EC6534FCC722D2D5A658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 ea281fea13bd5e4aa632ee1c4c1994e1750087e9a0c18cd88a789e09b0f342cd
MD5 bf0f6ddbd979aac804fbc92dc347dd7d
SHA1 891af06bfca3625fbe21a0a1f0ea066a6ce482c4
SHA512 041945e1bbd77a5e1692fdcba42995f448afec7ed71373e66af9d063f467418768b79caf43c2f4cca076bfd1b2bc04fe3b258d486dcece5d4940d86f0fd4e137
TLSH
T15531634D8D90DD5FF45844B314B3B8B873708DCC4620E363587C22767E1639A165B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe599d30.TMP
Size 1KB
SHA256 66bfcf812c975b8d5a82596c7d4ff7f39edc59e021e8dcfa48a207c16d01695b
MD5 278b62e45d1afdee97d90aaa22cc744a
SHA1 7a4482a9510df79f048500753fd178267917f38c
SHA512 53b12bdb29f7ac736950a59f494232b6b7bcfbd7dd20e83a8cf7bda9fc3b3a8c2a4a9f256130d20c9354fe1371bc6b52430602ffa1ac0775ba56d8a8e21d0ee7
TLSH
T11C31464B4A91891BF4C450770EA7B4B873368C408311B793987C6279AD21B9E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 93b3d748ba56fe9935ceec09878a44935f184fbbdeae06cb7d5b141745477e68
MD5 df60ae98b53f9f9fd3acff3e7d1c79f1
SHA1 b2f42546ed563ed3d6b9d6b99c6ddfc88260b6d4
SHA512 51efaec7edbabdc61d715ae3c9882eec999fa7fe65dda82910b70cb213ae4c838de83dbf07ffe8b2eadd6378695071372676dc947ffae3abf584e69949862bd5
TLSH
T101E0D8F62DE72E20AC7F47E628B245A44156B469C555AD8F2416A2E751A02682016C71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 044dd54c3de14bee275fe8404655fa42e65934fec433a8d1c3c9afcc755c20e0
MD5 9997d911deb44c49d9d4e07442ec6f86
SHA1 62c97d57a7bfcbe0c3f4005f6b4ba1f84793e53e
SHA512 bb69388e88223c582af257e00f7a9fcc28f86d6cd855fbcc7c8fe39ec272da0034174351cf66b80fde5e3a1eb228554a73364a996a183d296e6053f5707351c1
TLSH
T147A0022AC955A542C00102B0B4A101857390CC98460D23F1C1BD4095CDAC34199B6344
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f7c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f7c4.TMP
Size 48B
SHA256 887c78f14f67d37783f37449e297fe153a3e7309fa7963fe04ef7e5a3489c157
MD5 561d82aa74bcb9e93f476a0f608a932b
SHA1 3bf53d25118d83fcf6c93ad8be07e5a57b255e89
SHA512 6a1938b67ea969621a5c58d2a9a22c9a569c04bda9110e9ffc530aee495308b63ad1c0b84d2ac05f90036977a5742e860612a5c172527d11a8936e8e4ea64c38
MD5 SHA1 SHA512

Submit Download

f4003920a9f96dab_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\f4003920a9f96dab_0
Size 63KB
SHA256 8f54e6bc97e53e58b4f67ab6800239375fe54502fb4c19488a174203c264900c
MD5 00631f73e25a0082d1ef633a928ee1e7
SHA1 f6edcaa28a8234f472aca3ae0fe4d9f207d82b43
SHA512 0580127773287ece634ce2ade85f7718f25d60dbbb4e39f96271d268add9949ea00784f153f523e56dc76d513787d67bf697e95926b0af20eef1824455f43f1e
SSDEEP 768:EeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVP:EDJ0VPVR5yyJxGSV4V1C6c0VVEO1
TLSH
T1F0534BA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f583588a2d13c11bad614fd57b1f29b4b47fa211e75cc708abc804266af6f6a6
MD5 b6530f3f1849e876e6e15e26abb41acf
SHA1 5f56c02104db4554a2e6cbd8914a3dbeec780bb2
SHA512 5ff94e1ab401feeefddc713d3942907ad896d4c44cd47ca8e200247892e8ce0d061877234eed0dab6d063b0345b86a36b485f0cab4e6769ae7653f49b7a28470
TLSH
T114A002D131810806C61803B535E5C5807364FC59870A174276D4484BCC721515306094
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6ab3b0650c4fb3a55f5354a80a2f123e67013af1a1349bd9b84a3dbde27ae703
MD5 78353c4c281f4efbc4b492320c286b99
SHA1 a61ef084d18ce75a183afb2df3d3b755418faf46
SHA512 dadba86689f078730a37cd0fdd26bfd634c6fcc1c7cb0b1e2e2569c9043f2d508c8dfafb24700ff033a0a6d8205c07771765108bb11e15f2096336d8a61a3d22
SSDEEP 96:KPYDMoGi+cmypHUwcKsJUecI4oJ24Bp65OaQwgSmdcWUx/KsuUP/ILDUt+soKxCp:UlX63Q
TLSH
T171912E5235BB02422D3E3A0D81E197279A827163351EE53B7BAC21B54F67E214EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595ad8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595ad8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b3fb3d38be192221fec0c3c7ed2688890bff5df9a8cc4415f541f411f7a6a538
MD5 4a97b89d2a7213f14bbd640357f630f8
SHA1 5e1ca9167d5b7a28dfa90fd58e6134c345838371
SHA512 89df1218ffc2c38e4c2b4e04166f9f249379cb787253232ec1beac3d805d61944bd055573a0611da9ac5d1cd74b0e20788c556e0671e3df9d38313bbd64405f2
SSDEEP 192:udNsNoKQ0QJ5sZErbJQmiU1+kW4H/+jV0jzor2IXQN2B5cFTM9qZU8:OsNoKvQJH/d5f+682IXeDFMMU8
TLSH
T13F321A3AA978EC6B5DE2A641F04732639FE411279BC56F84E6EC5B1C00CF6AC130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 49e76998d87faf8f7a814b1434d7650a75a3d482a9c7f166ce5880dc63e6a498
MD5 e7b27e56484d9071bfa91252ec757369
SHA1 0423bd2f2ddc15caeff2435c11a50208353c08c2
SHA512 48924da5bd3d79bf5466084a1849963f93796d4d85ffa5b7d85a05ada1c15d3b226f32ba5199b216f77d979a3f348544e5b3c26cd4957149b6f1c0692a48d977
SSDEEP 384:9iFitNn/s3n9SeOsNf8TUNTUlIliTEQJHBQC2f+682IXeiFMMOObjI9G6w7EUm:0Fij+9QQwg/BCmG9MM29MM
TLSH
T1FBA26B3B5858DD7BADE29A41F59A32678FF4416B8AC66F84E7EC9F0C00CB5AC0306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e98bc531b3aaa66b5ec55b51b613557a5b21b7cd63e76500d84612dc91c9327a
MD5 9d9ecbc6433c1f656bd2bf12e79a384f
SHA1 f551ae792a38b997b629ba737c9a247a3c649050
SHA512 ca3c1d07aed14693073e249fabe572c90e2794dc866dc4b8f0a68edf64fd1790f8c7aef308f8a8374fd855faed43306747f1478a9542d07288987955607bf59c
SSDEEP 192:udJsNoYVQ0QJ5sZErbJQmiU1+kW4H/+jV0jzor2IXQN2B5cFTM9qZU8:gsNo2vQJH/d5f+682IXeDFMMU8
TLSH
T12E422A3AA878EC6B5DE2A641F09732639FE411279FC56FC4D6EC5B1C00CF6AC130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 32be33fa5a245acd122183fb2169c801dcf4b81409f887701428bc7601a8ee47
MD5 b030980c1e23ccc1296131cd450c43cb
SHA1 6acad826b472b4de230320aae8489941d198d7de
SHA512 b6a30794f39edd61820001f6fe347752c779e326e97a5408bb478996cc555def217ef1e76c74c2b0c299ff0bc228178644c28e38346da1eb5fe71b8e87dbe20b
SSDEEP 384:9iF/isNY8TUNTUlIljTEQJHUeC2f+682IXeNFMMU8:0FqxwgiACmGsMMU8
TLSH
T16D62F8375968D87BADE69A41F55A3213DEF50167CAC5AF90E7EC5B0C00DB29C130AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71eb9a040b58ebf9f4ed988f6c76b4921ffb022acd81f140910a314477e46f09
MD5 e3f4412041d97b2735a4ddbf90a8202f
SHA1 7d0fd00069f9bc29bbb1e4262822efa3da21b678
SHA512 bd6610c004833645a75af49a041e562af20acbb12178508ab455bf1281fa5a1433769062931514bf829766276dc75492acfa1a296011760954c6935dcba9da68
SSDEEP 192:EONQ6hZ0QmiUyoGpc/+jV0jzor2e5wOZMMdlU6:EONQ6o+pu+682t2MElU6
TLSH
T1D002DA3968787C778EF2AE45F48737135FE5116BA9956F84DAF85B1C00C769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 081c6c36cd01e20f7b61d4b32a162f81ee7c589ddca8db83cbc644806d341911
MD5 d63aa928be2de180ed5444aacd94f2ce
SHA1 4571418d68e25b2daee50dc8dcdf418830b92242
SHA512 c4ca65f0f4548ef34d8e5c354c99e9017704e68cd142105cb1316c5297c8acb8a7b49fc03cc0e64246398476c9b5f7f0c205142a11f01202d240a32f673906af
SSDEEP 384:9iFKtNn/s3n9SeOsNf8TUNTUlIliTEQJHwrdf+682IXeTFMMOObjI9G6w7EUm:0FKj+9QQwg/FdGcMM29MM
TLSH
T175A26B375858DD7BADE29A41F59A32278FF4416B8AC66F84E7DC9F0C00CB5AC0306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 64d43153acf2dc5b229566e882575db2ad10c9107de50368044debbfdb394764
MD5 09a4ce7ea9105910e53534bcfadb9415
SHA1 ca2d83368a4cce7960395eb6fa2e22b03ab58866
SHA512 b883ee6a0cc1cd71b374ff22c6d7466e2480a6ec1562b70b3e3bb7c5a2808b6e95c73e0e9ec54f93fe57b3b223a8ab0a7c84d6124a4bc36a0daff7b3a6e01ce9
SSDEEP 192:uHJsNoYqQ0QJ5sZErbJQmiU1+kW4H/+jV0jzor2IXQN2B5cFTM9qZU8:+sNojvQJH/d5f+682IXeDFMMU8
TLSH
T137421A3AA868EC675DE2A641F09732639FE451279BC96F84D6EC5B1C00CF6AC130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 351e268494485a801a0472a86c0273381cbc993852e5fed7a6c23f083edc8c1c
MD5 86bd753b66d12aad5baa949b4ec7e6ce
SHA1 41c6261372fce91cf9729db6c719e75d9a190b21
SHA512 41ff033baa7c6e75199326d3d0eaec12ba62b675b6039e50864543381171891ba1802c39973baf5db444ffa5a77592a0e3342977be7e4d1f612397c173358881
SSDEEP 384:9iFGtNn/s3n9SetsNA8TUNTUlIRiTdQJHwrdf+682IXeTFMMOObjI9G6w7EUm:0FGj+931wgwFdGcMM29MM
TLSH
T151B25B379858DD7BADA25A45F59A32278FF4426B8AC66F84E7EC9F0C00CB5AC0306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e742f92c26df5db16d9f73f7fb5071b6e374f0326cf8e643e428aa100d700a0c
MD5 77b2f16179f9abcb77e582778366b991
SHA1 2ada971ea259fe6fd70d70edc98a5194d7b7c8d2
SHA512 2d0144fc69fed8643e3423ae9accde910ec93871926811ba39fd16dc4465e2612921f1d5c40dfe32a48e425950d3f7b31f7df7b8945935a9c3b03276582dc567
SSDEEP 192:MONJ6hZuQmiUyzG7c/+jV0jzor2IXQN2h5cOqM9qZU6:MONJ6WL7u+682IXeh9MMU6
TLSH
T1B912EA36A868EC6B5DE2A651F09732139EE55227DFC57F84D6EC2F1C04DF6AC1306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 27b6537cbd044061f613fef4fb8bfa7cb9a1dca944a501d581dea00a45f6bbf7
MD5 7593fe4f76134013ba680f4e32f358df
SHA1 25b5dea56b3de58c6cd76d8f09e833ef3e8434f7
SHA512 20e8513b62838cb8e461db27cacea2236ff3e9e35dd8492957248cb71bb71d85988af6b8795328dcc081f33292d1b5bbb1577deeff552c6b504e88589faf8047
SSDEEP 384:9iFnOsNY8TUNTUlIljTEQJHBQC2f+682IXeiFMMU8:0FOxwgiBCmG9MMU8
TLSH
T1D562083759A8D87BADE69A41F55A3213DEF50167CAC6AF90E7EC5B0C00CB29C130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5b83e97da98b970cb3512334872b9e743cb097c74bdd90c447da8e5d7aad91d4
MD5 7b32a52d97a176bac3f3f7323e4ca580
SHA1 21769602096071945b01092542456f1644441629
SHA512 a640747139ca6b13d287fc1cfffe5227f998fa63a5468cf31f3820cf171d853e6a56ad131ff64ba97a987832987c11798481b90c036f5c228a09271d34f590b6
TLSH
T14CE00202530000BBD02C033001C75A20B9F240B003F702C54A2441781D737042F34F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a2e93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a2e93.TMP
Size 392B
SHA256 657606eac6a7abf49428c39252f4e6322d4c76a8173f9fe94a27d28b36c7ef24
MD5 27e723dbaa3c46de7dc4703b3f5a5986
SHA1 122598b9cc511df35c0059f45a129ae323f2716d
SHA512 91b1d6946106f5743cb6f1ae31b4501cae24a3f238d69c3a2805ee187a597b357b64b6047daf0990cd52f22614cef5d0567f9283bd3f80823daf246e521d0c0b
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da93ba964d14dcca5a8821ffb35896a22d38e8d1a4ef7d93b2b4b343ae06ea8d
MD5 d7f524d9ea9616ed9e57df272af56096
SHA1 f77a4c0e2d8c8604267a72a3fc9a2a00e0ee6b14
SHA512 b4e1016db202b70048082de92bbb0092fa4cc1265fa391ad662e1db9989d5a7bb7b55aadba6df1e174576eb78400d985e942d796ad6f9286dbea80b242180b33
TLSH
T110412A98A6FE1148B3B76F1AABF7A4AD487EB9772F17D45D00010D8F0666E40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

processor.ps1

Path C:\Users\Admin\Downloads\processor.ps1
Size 6KB
SHA256 4a9039962a9b9053132403845e57517731c4578154b4f9fc576b65b5fa871a8d
MD5 ababa9ea3ade9bf2e6b886169b96397a
SHA1 7ea144237a05bb5e9fe9154eccf4d63fc93b0457
SHA512 16c9c5d6ae7802039319bdab183273caeb477cde92d4ae23869cfb19a26f35357fc7628fac4045482b7c497c2863ae9fc5017b5adf76942bd7bf8c2bf7855d55
SSDEEP 96:UgrsOuC+YZdF3Khc7RNZfSRGLB+7eqHAeQci2E5weFJ/0YLF8:UgrsOuCHlSRGLB+7eArtzfeFLF8
TLSH
T17ED13119A545426E57F3637E4D85A408FF8B512F87802E947A5CF0A4BFB802DC3B1DBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.b64.crdownload

Path C:\Users\Admin\Downloads\system.b64.crdownload
Size 36KB
SHA256 b92a2867d8eb3109c69238ab3de70c6616211121cd604858f7770a177570e003
MD5 38e4b43d5e057771799a521830e77f6b
SHA1 3849c82842ec2fcc8c393d68f81418cad443cd24
SHA512 6d14a57aebd558e6299643e25bb549e6fa8862cef47dec33aaf3eb55967073e3c9f1bb916ef797d51295f16021766da26979a0c1fae7e7b2000152cf292bc094
SSDEEP 768:q607R8CKH1tjHxFcBdDvKvHvncALpM18TzNE5yHFFaI439lF8BaW68tLHLAOrIy:y7aCKjRFc2cALvGaFalcaor5Iy
TLSH
T11C034BF1CEC60F9CBE63264E0CDD68E249FC579F181290AA5E61FBCA8702C8165DB0D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download