hxxp://mrebe[.]glamai[.]pro/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mrebe.glamai.pro/
Sample260731-n4bl4aaa44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5292	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299726183192130"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{2C5F6B54-C751-4C70-922A-D47D355FD83C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6208	msedge.exe
6208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs

pid	Process
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 2092	6108	msedge.exe	86
PID 6108 wrote to memory of 5292	6108	msedge.exe	87
PID 6108 wrote to memory of 888	6108	msedge.exe	89
PID 6108 wrote to memory of 888	6108	msedge.exe	89
PID 6108 wrote to memory of 888	6108	msedge.exe	89
PID 6108 wrote to memory of 2072	6108	msedge.exe	90
PID 6108 wrote to memory of 2072	6108	msedge.exe	90
PID 6108 wrote to memory of 3300	6108	msedge.exe	92
PID 6108 wrote to memory of 3300	6108	msedge.exe	92
PID 6108 wrote to memory of 3300	6108	msedge.exe	92
PID 6108 wrote to memory of 1340	6108	msedge.exe	91
PID 6108 wrote to memory of 1340	6108	msedge.exe	91
PID 6108 wrote to memory of 1340	6108	msedge.exe	91
PID 6108 wrote to memory of 5312	6108	msedge.exe	95
PID 6108 wrote to memory of 5312	6108	msedge.exe	95
PID 6108 wrote to memory of 5312	6108	msedge.exe	95
PID 6108 wrote to memory of 5524	6108	msedge.exe	96
PID 6108 wrote to memory of 5524	6108	msedge.exe	96
PID 6108 wrote to memory of 5524	6108	msedge.exe	96
PID 6108 wrote to memory of 3524	6108	msedge.exe	98
PID 6108 wrote to memory of 3524	6108	msedge.exe	98
PID 6108 wrote to memory of 1304	6108	msedge.exe	99
PID 6108 wrote to memory of 1304	6108	msedge.exe	99
PID 6108 wrote to memory of 5576	6108	msedge.exe	101
PID 6108 wrote to memory of 4536	6108	msedge.exe	105
PID 6108 wrote to memory of 4536	6108	msedge.exe	105
PID 6108 wrote to memory of 4536	6108	msedge.exe	105
PID 6108 wrote to memory of 2828	6108	msedge.exe	108
PID 6108 wrote to memory of 2828	6108	msedge.exe	108
PID 6108 wrote to memory of 2828	6108	msedge.exe	108
PID 6108 wrote to memory of 1068	6108	msedge.exe	107
PID 6108 wrote to memory of 1068	6108	msedge.exe	107
PID 6108 wrote to memory of 1068	6108	msedge.exe	107
PID 6108 wrote to memory of 4388	6108	msedge.exe	112
PID 6108 wrote to memory of 5848	6108	msedge.exe	113
PID 6108 wrote to memory of 3532	6108	msedge.exe	114
PID 6108 wrote to memory of 5180	6108	msedge.exe	115
PID 6108 wrote to memory of 5180	6108	msedge.exe	115
PID 6108 wrote to memory of 5180	6108	msedge.exe	115
PID 6108 wrote to memory of 2876	6108	msedge.exe	116
PID 6108 wrote to memory of 2876	6108	msedge.exe	116
PID 6108 wrote to memory of 2876	6108	msedge.exe	116
PID 6108 wrote to memory of 4172	6108	msedge.exe	117
PID 6108 wrote to memory of 4172	6108	msedge.exe	117
PID 6108 wrote to memory of 4172	6108	msedge.exe	117
PID 6108 wrote to memory of 4308	6108	msedge.exe	118
PID 6108 wrote to memory of 4308	6108	msedge.exe	118
PID 6108 wrote to memory of 4308	6108	msedge.exe	118
PID 6108 wrote to memory of 5228	6108	msedge.exe	119
PID 6108 wrote to memory of 5228	6108	msedge.exe	119
PID 6108 wrote to memory of 5228	6108	msedge.exe	119
PID 6108 wrote to memory of 5504	6108	msedge.exe	120
PID 6108 wrote to memory of 5504	6108	msedge.exe	120
PID 6108 wrote to memory of 5504	6108	msedge.exe	120
PID 6108 wrote to memory of 3788	6108	msedge.exe	121
PID 6108 wrote to memory of 3788	6108	msedge.exe	121
PID 6108 wrote to memory of 3788	6108	msedge.exe	121
PID 6108 wrote to memory of 1040	6108	msedge.exe	122
PID 6108 wrote to memory of 1040	6108	msedge.exe	122
PID 6108 wrote to memory of 1040	6108	msedge.exe	122
PID 6108 wrote to memory of 3472	6108	msedge.exe	123
PID 6108 wrote to memory of 3472	6108	msedge.exe	123
PID 6108 wrote to memory of 3472	6108	msedge.exe	123
PID 6108 wrote to memory of 1752	6108	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mrebe.glamai.pro/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe4c6ec188,0x7ffe4c6ec194,0x7ffe4c6ec1a0
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,17943925410028168661,8105039072935410960,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6344688418641492245,16649188710327996203,262144 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,143285936240782681,18357060383052367913,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,17980187949085801750,6921549650573158580,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,13725409946643974071,8816674205124660687,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4992,i,9391032370178548033,1380364739570723590,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5104,i,12682571573900390777,277169728040322737,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,16133139884334141536,924922128218610185,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,9852724055155319838,15284682463159462737,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,5945929186139974965,14244431135251626670,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,5945929186139974965,14244431135251626670,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6324,i,11069125175503607841,9958819314955849238,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6444,i,13495494059781050661,10833914384981112155,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6344,i,9012687563467648028,7163713556327613710,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3610529570302955830,13346544318787533937,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3964353596990023879,7090173383585124196,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15369991665792322306,4270494253990256130,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6892,i,17028776723671352158,4434502772606656189,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6080,i,5480945764950173199,9483431963617696065,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7160,i,9743400955751854457,3667710335329998351,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7284,i,1863089829316107459,10729943727210194198,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7464,i,1317628911117869332,9534282435342903342,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7408,i,7115384751115398589,17869829353961947897,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7768,i,1887132113116893276,18220964715715393125,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7456,i,8189400729206311538,15466026545234981420,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8076,i,14070738255191376846,16183024051781007671,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7804,i,11225455075852219034,10510232257737525915,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8344,i,14589992978902235170,18207063621021429489,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8500,i,2293467586222798027,12575665292910886161,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8480,i,3124399423380556764,8724209377678054345,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7644,i,1160480913700613896,3318241825702398228,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8664,i,11862668064347315800,16124282657125707009,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9000,i,985372718944437888,2725306830435436248,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9176,i,5600326300435449708,4660561894828692006,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9344,i,1701691230847159801,12764927028278194119,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9524,i,3940023614116919787,16326552906350568018,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9644,i,5880797920100464968,10377123160232513614,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9824,i,2167634701788103548,4992230749143091283,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9792 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9188,i,13584983835858984973,1366717225885620019,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=2920,i,5342496809612093144,17907706032088289902,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4644,i,5929460362654295949,17480545691440343858,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9024,i,13165175184915798086,7662872853809753271,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9176,i,17680084396863580986,1230584202734592950,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9376 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=2908,i,3383864537003489142,1602087856924157364,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8160,i,4005678911896748643,12847877504148366708,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9540 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9220,i,5982305386843390019,11683197137957850729,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10096,i,10213994180545348139,2132624838666162788,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10108 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10128,i,122379537218648607,2731305545298349649,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9956 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7856,i,958379000298262057,3489371856822816589,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9256,i,12852107700801734490,6979802478168816464,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7856,i,230955712870781712,5936872934560413891,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5468,i,5206065597080114457,8278871508356514833,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10340,i,9756419412151459709,1411309691762811996,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10540,i,16836427206426155442,4615258737903076584,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10500 /prefetch:1
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13861723567846858630,13111923821653526993,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:8
  2⤵
  PID:7072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10492,i,11589533630358870233,11151140396588317374,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10448,i,4988322883630651232,3023923069337928407,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10412 /prefetch:1
  2⤵
  PID:7140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10120,i,6005613693236165909,12309476029499245878,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9972 /prefetch:1
  2⤵
  PID:6324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11180,i,11260677194374349849,6552653611067012585,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10300,i,9443567147593651260,5717298375728067748,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7576,i,563101613586782609,17534119599285529806,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7796,i,12790025117629717129,7012922427164488982,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10296,i,1999398117268078419,7806623822662216728,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10088,i,9391642918757106825,10863658828206219330,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7476,i,2282726431538522297,13416279103502970361,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10324 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9808,i,14487453639183565573,4106196305825341604,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9924,i,11120571840315523120,1093264731131582017,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11088,i,15341223443056300451,755105587590534149,524288 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=10384 /prefetch:8
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8104,i,3694065378955155339,11754938905990521668,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=2176,i,7199491163165732096,9798053596467877016,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
  2⤵
  PID:7044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7976,i,3919545549739784341,14891418537032253236,262144 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9060,i,10444492796321521598,9230919081207570673,2097152 --field-trial-handle=2200,i,6748201113184926586,5061434481629918477,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
  2⤵
  PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a5d32448530571aa83cf3a8631dc60a73c777c58d62fb7fec4b9417c6c7201c7
MD5 d780bdb73f05cac5a60bb62316b2c478
SHA1 97541ffa8b3124d375bda0882ed75a3257345574
SHA512 43ccb5369a12e5448f480e85b410cadd677dbfc879ce433ed46dd829e2ba64133d925b32fbdd22e262d42a185ffd26746a933987577c517d6bdd87542bb2e850
TLSH
T145E02BA6CC21FC3708FD4718649D4756E750131B3A80495F3A3C81098FF862746C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a179c53fa939d1526521a7bed2d7d11216d495b64779d5b6795089b57cf22466
MD5 0feb5d11bb48ae96b5518c34e0c78ad1
SHA1 08ec5ee62117dba985deef027d119637bfffd17a
SHA512 d1eb06ed32b48ff6d0efaa873b9f28f758941cf2e2e0ca547dc60083a21cc649eb8750aba61a1e4ca85b35ff8d64153cf003fbcffc8a25efd63a28f31f9ced1c
SSDEEP 96:dQfdPx4cp07XCYDRml02SvOxsnWxraeQA9u4fvFwqyjmaZ:dQfJx4TrCYFQ1eADxraDsukvFJA
TLSH
T156C10A3744821E37EB222A32C2D11D1570B7ABEFFA534EB6E1C15C31B6CE78161654AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cd37d0442f87d23fab38ee65a192f4aa772735381aefcd80b42e4b5e165e5627
MD5 f024325e098ab7070415eeb009502a48
SHA1 28e61e512ae171e7172436db01ba146ee72876d9
SHA512 8c807529994a820ce9e46dd0ab313968c7a549134ce9f9d0fb5d30583fb9f00817a8b0284c614077dd9fe7481ef5d9683fd37fcaa4e8066671170ebba51419dd
SSDEEP 96:CQfdPx4cp07XCYDR3sl02wvOxsnWxr3LNQA9u4f2Fwqyjmaf+:CQfJx4TrCYF3G1MADxrbqsuk2FJu+
TLSH
T1C2C10A3744821E33EB622A32C2D12E0570B79BEFFB034EB6A1C15C30B6CE38161654AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59abe6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59abe6.TMP
Size 3KB
SHA256 892c578eba5cad9e1f43c8cef92108686237f757c0238e817ebf0f5efc08dc3e
MD5 5e509aa2648f551c539b86e3cde640bf
SHA1 0924b5571114273c9924b80e8b77cc50b55dc0de
SHA512 0222d16ebc4688b0065816c2aef29b65c95518cb833a5c0a455633c8e28e515244302237abeafc5d561acfc80ab1f9dd1aeed5e893c3c45c7fed9733f823cd0c
TLSH
T1C781B23345421EB3DB100A33C3D21E14B03BCAFCFB638E96A1C6557596CD792817596E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 37KB
SHA256 5a87a7f46038fc313d142bf24f299f5104f651b1b74f4454716be36204c07169
MD5 e459fdf905c45d890d99490f7f60f5d2
SHA1 689bc57a5b5708f571c0970e89ad795d06c5a9f2
SHA512 9ef7ba0fed9f0bed374761f650835ecd26e01296029bb9168b82318d9b1086a691bc3699912eb62357446018d34e43855f1f55c9c791240c0b26054012c9dd37
SSDEEP 384:D1RVu2mcZ8eVJpOyJenWpeMCIeO4cABegoePrQOwD2KnP92JsaaiGaycoakEkOUg:1QxE2shl5tRr2uGZ1
TLSH
T1E9039CFB83F48A7EDA2152F0AE156E1BCE580925476C393ACAD4AE06D3F1571E10274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0ce2c5a7faa9fee15f812a216f269f58d73de5f00f13bfdc8bc5c1261ccf642a
MD5 cff9c010c856a01be4adb5db49169d00
SHA1 1d360e8498ddd963ffaffbc6901b6d8e81e4478c
SHA512 3ba69c4df0dd7bd05fa985592a8b75ca9fb1e0bca0de0b0652f1c7589a7854d2c8426286831fef2631401fbe3f2eef15c3391353f4dd5e29e7e828061e62edc4
SSDEEP 192:sxZm7RQyMqZjK1Ml8MkS/fjYssNzaZdbzodpGcqHW6+WNtxt/YvBu/SPwwIgjfJ:sxZsZMS/fEssNzazAwHbl/ehjh
TLSH
T13972D9466A3459778DD7D21AF645BF93D2F91023E2904E44A9FC8A0C00EBBED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 634783ee198bf5cdf653ba6879b6a8ca52db241aed689e90c8926b9858201eec
MD5 e6caf6a456d0bff5789f8acfc842630f
SHA1 a3dc6ea746a4b7c04e089eda98e5ff27c6123dff
SHA512 f1285facfcd9c5a85e52480d10546c83aa1a749d99d9edb1f3f99772c0d94d9bee7a3f9990f4df306c4fc34845444ef276289baa79cfce6f77ce3a646deba12f
SSDEEP 192:sxZm7RQyMqZjK1Ml8UQskS/fjYsoJZdbzodpGcqHW6+WNtxt/YvT/ZPwwIg54fJ:sxZsZq3S/fEsoJzAwHbl/mhqh
TLSH
T11F72D8566A3459778DD7D21AF645BF93D2F91023E2904E48A9FC9A1C00EBBED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d1a3d1aaf7898ea_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\2d1a3d1aaf7898ea_0
Size 63KB
SHA256 ba4425669cfcc865e83232db402386267b6515f2880aaf75588f6c5c66f1cca1
MD5 1ddc12776eec90e480f82a7af30ab77e
SHA1 5ced8a83d389744c2200b1812a02fbda627bbdf4
SHA512 a9edbaf90a4854db3e333b5dc3dc3e6a6cf6b95b891cb733b0d7d6dc2ef1da8e6b5ea83f095d49a2b42ec98dbca09e5ef883ef152ff9c6b28e4f0565f43baee7
SSDEEP 1536:0K61j5RmtRXNyqx9XY4JuqdV6no83iPj:h6joNY42qj
TLSH
T1FE536BA63371B8B3827BA1B190AF170B713ED167B404C4F8A194EEE54A54B9A0177F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 45b27f850c2eade54dddc25e2591f041d0d7491a3286dab449d1d3133c4c45df
MD5 24dba1ee8233974ecdde265f4e86f66a
SHA1 76845766b9878e784330516c4be59b21e03bbe90
SHA512 ea2174e13ca128aad45c8eeb6fa6b316618874f7ddeecaad9aa8778f2e62b0e936f5d6cca5287a3a2dfe1fe60a671e85e157bfa5b8413fd3adbc4a7eaf596f9f
TLSH
T15BA0021055413105D19022B56F96828173949A682341020145E10446CC7D1B25549250
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ad6613f4d837d5732a186e0fb16761f583b4e4aaf202f295b4b76a15314654d6
MD5 57ce48e3ccd066d52eef52ac56433de4
SHA1 6b6ecbe9925efaa0a5c465831cc7273c49756ebe
SHA512 6fa4ad7f8ed4597eb3ff5b32621dc02172655461c0c48147313b6a1d9a285b06836d4cf5f1be4fe70c398d395b6167c8b412758259c3b64dcf201b479391dbbc
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGd:05ppxnY753RNBvRJJdt7p5J9j6d0
TLSH
T18CB2695A703E0211397E298CB39696364F4235A37058E4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a13b1f919cf088147d09f704eeffd8a48b3c4b14afc227d5da45b454e0504f75
MD5 91e48ea08a5d7ae913143a64d16225c0
SHA1 707793d5e1f7577e05f7464eeff879d458ca47f5
SHA512 3997a72a0138bbcb159e22bb79bd72b4c0df83c8ba3b879c45bdadcf2029bcfd0eb1720fae2707473d6de62f37273e61f1a553cfdd0fbb19965e92b320884de0
SSDEEP 384:nsiFiZcIsm3sNc8TUNTUlI4ZQckCrXFRphiftG4WXGXMeZyOObjI9G6w7uVty/7r:XFQ33ZwgEkGvoG4+AMeZy29MuS
TLSH
T194F2C3F298D78976E9AE4B87A77D2D429EFCC153B5884A84B7C85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c163e3c912baacb7339abb233ffc1cfcbbff9248ff221b59963d97a3ceede9ae
MD5 08203208711910c57289a39ddea6416b
SHA1 354da6794b476c73d1ead5d00619e558abfed062
SHA512 3ceaef69105954e16a760244963cdc70cdb35d1974483f60b9c3b3c9b7a1faf7f220231d5ff455ca3fb79d4b8d3edbe8b099c13b63cb6d4c34ad5a5aab8d9673
SSDEEP 384:npdiFiZcIk3sNc8TUNTUlI4ZQckCrj4RphiftG4WXGXMrZyOObjI9G6w7uVty/7r:pUFQk3ZwgEkPvoG4+AMrZy29MuS
TLSH
T15DD24A32EC64CAB7EDE74F96B64A3A439EF0416396CC5AC4E5D95E0C01971AD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 eed612865e4432a626719cd82b60bd2b299864f8e313c19a980c68fe42b84fcc
MD5 f715176238980de2f2b7bec06b7cf7f7
SHA1 848e114150f112cfa893877b82bab31d30036421
SHA512 21666307e7fbd7aad5c0b2549c9002c42ed0845f86028d29984c970aad6fc9e096c68623f5ea1559518ee26241295d7f16a5235885c6db66b8bc971c8b7478a2
SSDEEP 384:nIiFiZcIk3sNc8TUNTUlI4ZQckCrX4RphiftG4WXGXMrZyOObjI9G6w7uVty/7Ic:TFQk3ZwgEkPvoG4+AMrZy29MuS
TLSH
T109D24A32EC64CAB7EDE74F96B64A3A439EF0416396CC5AC4E5D96E0C01971AD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d9ce0acac8a664c631f9e993370185bbe6dae053d60084c5f2135167e0797dca
MD5 0d090d93636aeabd124529b1d43aacd6
SHA1 5e808e91ad6cd8c9afe3a42cc62f9e9680665d81
SHA512 033c2a8ee809d9fd055c7189d8d4459b4aa359898608c3b10ee74339e51e2f5da464110f52b9deeb795caa03da6489666170220a019778d57ae7bc6f7ce006c7
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9l4KphiftG4WXGGHpJe4KV8p0nLaty/j:pVFccps3NwgbkUakoG4+pXI8p0nLP
TLSH
T169B25B36EC54CAB7EDE74F99B74A3A03DEE0526785D89EE4DAD85D0C009719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 57b77f6c6f6aa479741f5d02954d6d48d70f9a612ebc6b550a1a0b3ff1210e26
MD5 4d70d617be677a5f5069fec1b7e312ff
SHA1 d14ec960a7dbd38a5f5a0e17e1c7c36e6d3544b2
SHA512 151c7b30e199bb822f625872e248b9a79ab6907c4b304a59a66cb97e3b48be3d18e85a8c726ff9b13cc2268f93530f97f3ba2056c4e297b9498fe84e6392f7cc
SSDEEP 384:npKiF9CcmyWCs3sNI8TUNTUlIm2QckCr9wNSphiftG4WXGXMPZye4KV8p0nLatyL:pBFccps3pwgbkUScoG4+AMPZyI8p0nLP
TLSH
T100C25B36E854CAB7ECD64B99B74A3A43DEE0526785CC9AE4DAD81D0C00DB1ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3585b12d8b6871b3e8b4b128db827bd32ca695190e34767eae658a34a4313b12
MD5 7dda7492d511907c47ae4002ad4e814d
SHA1 ca4fe51db7ad8eadfc604288f5b68b6512921489
SHA512 99336fe61b21251c4460bd3e28b328f4419613bb8feda4074c4f28f43bb67e3ccc659135d01fa667672cfeefb3150af60847f7e7c81bddfc8e792c6c64e49645
TLSH
T164412998B2F91148B3B36F56ABF6A96D147FB9772F0A949E00010D4F0662B00D861B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5576-301-0x0000025E358E0000-0x0000025E368E0000-memory.dmp

Download