9936f31dee38051bf646499fa2ed057f4f9ecd9791cef144732dacbb0b3c5db0

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
u2211.exe
Size 11.8MB
Sample260824-pg3yhagj7v
SHA256 9936f31dee38051bf646499fa2ed057f4f9ecd9791cef144732dacbb0b3c5db0
MD5 ee53abde16b9c747a67f08cb423fb7e0
SHA1 abe1d3699a448d1587772dd41bdbb17f1ee8dca4
SHA512 eca88569cf20b7220e58d5d7711d90c5d2508268040e897fe70759fe40bc91f86e996686c878e8bf32d3cb1ca9cf40a3e9c198d4c51a2aaed617817d1199b5e8
SSDEEP 98304:fopie/X71F2R3rXGKIJo52/dECAyWrU5OcMucjhnkBqFiQUnJgzYQM:wp82PR/eXrrcMhhbc8Yt
TLSH
T17EC64B90F9DB40F1DA436870946752AF63302E0A8F24CECBD6647F6AF8376D20E76159
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_2115613487\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4064_741069793\_locales\lt\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u2211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
240	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320475505148649"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{1DFEEC40-DC33-4E6B-BA0B-850E65C19D25}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4364	u2211.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8136	msedge.exe
8136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1284	4364	u2211.exe	89
PID 1284 wrote to memory of 4064	1284	rundll32.exe	90
PID 4064 wrote to memory of 4600	4064	msedge.exe	91
PID 4064 wrote to memory of 124	4064	msedge.exe	92
PID 4064 wrote to memory of 240	4064	msedge.exe	93
PID 4064 wrote to memory of 124	4064	msedge.exe	92
PID 4064 wrote to memory of 124	4064	msedge.exe	92
PID 4064 wrote to memory of 5624	4064	msedge.exe	94
PID 4064 wrote to memory of 5624	4064	msedge.exe	94
PID 4064 wrote to memory of 1620	4064	msedge.exe	95
PID 4064 wrote to memory of 1620	4064	msedge.exe	95
PID 4064 wrote to memory of 1620	4064	msedge.exe	95
PID 4064 wrote to memory of 992	4064	msedge.exe	96
PID 4064 wrote to memory of 992	4064	msedge.exe	96
PID 4064 wrote to memory of 992	4064	msedge.exe	96
PID 4064 wrote to memory of 4968	4064	msedge.exe	98
PID 4064 wrote to memory of 4968	4064	msedge.exe	98
PID 4064 wrote to memory of 4968	4064	msedge.exe	98
PID 4064 wrote to memory of 1528	4064	msedge.exe	99
PID 4064 wrote to memory of 1528	4064	msedge.exe	99
PID 4064 wrote to memory of 1528	4064	msedge.exe	99
PID 4064 wrote to memory of 3604	4064	msedge.exe	101
PID 4064 wrote to memory of 3604	4064	msedge.exe	101
PID 4064 wrote to memory of 4672	4064	msedge.exe	103
PID 4064 wrote to memory of 4832	4064	msedge.exe	102
PID 4064 wrote to memory of 4672	4064	msedge.exe	103
PID 4064 wrote to memory of 4832	4064	msedge.exe	102
PID 4064 wrote to memory of 2404	4064	msedge.exe	105
PID 4064 wrote to memory of 4240	4064	msedge.exe	108
PID 4064 wrote to memory of 4240	4064	msedge.exe	108
PID 4064 wrote to memory of 2184	4064	msedge.exe	109
PID 4064 wrote to memory of 2184	4064	msedge.exe	109
PID 4064 wrote to memory of 6064	4064	msedge.exe	113
PID 4064 wrote to memory of 6064	4064	msedge.exe	113
PID 4064 wrote to memory of 2564	4064	msedge.exe	111
PID 4064 wrote to memory of 2564	4064	msedge.exe	111
PID 4064 wrote to memory of 960	4064	msedge.exe	112
PID 4064 wrote to memory of 6064	4064	msedge.exe	113
PID 4064 wrote to memory of 960	4064	msedge.exe	112
PID 4064 wrote to memory of 960	4064	msedge.exe	112
PID 4064 wrote to memory of 6064	4064	msedge.exe	113
PID 4064 wrote to memory of 6064	4064	msedge.exe	113
PID 4064 wrote to memory of 612	4064	msedge.exe	114
PID 4064 wrote to memory of 612	4064	msedge.exe	114
PID 4064 wrote to memory of 612	4064	msedge.exe	114
PID 4064 wrote to memory of 2644	4064	msedge.exe	115
PID 4064 wrote to memory of 2644	4064	msedge.exe	115
PID 4064 wrote to memory of 2644	4064	msedge.exe	115
PID 4064 wrote to memory of 4416	4064	msedge.exe	116
PID 4064 wrote to memory of 4660	4064	msedge.exe	121
PID 4064 wrote to memory of 4184	4064	msedge.exe	122
PID 4064 wrote to memory of 6104	4064	msedge.exe	117
PID 4064 wrote to memory of 4416	4064	msedge.exe	116
PID 4064 wrote to memory of 4416	4064	msedge.exe	116
PID 4064 wrote to memory of 4100	4064	msedge.exe	118
PID 4064 wrote to memory of 4660	4064	msedge.exe	121
PID 4064 wrote to memory of 4660	4064	msedge.exe	121
PID 4064 wrote to memory of 4508	4064	msedge.exe	120
PID 4064 wrote to memory of 4296	4064	msedge.exe	119
PID 4064 wrote to memory of 4184	4064	msedge.exe	122
PID 4064 wrote to memory of 4184	4064	msedge.exe	122
PID 4064 wrote to memory of 6104	4064	msedge.exe	117
PID 4064 wrote to memory of 6104	4064	msedge.exe	117
PID 4064 wrote to memory of 4100	4064	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\u2211.exe
"C:\Users\Admin\AppData\Local\Temp\u2211.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 url.dll,FileProtocolHandler https://home.ultrasurfing.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://home.ultrasurfing.com/
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffd1e07c188,0x7ffd1e07c194,0x7ffd1e07c1a0
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8511692847057481327,13372995528965691130,262144 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,11846282926623084186,11434604909399358449,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
      4⤵
      System Time Discovery
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,17338121586832175001,2219064446801332890,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,12550186235637529168,12410885636157274499,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,14306326192467659468,25495175612675590,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,11196868593262323519,7366521497149005544,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,5287038699925902754,6547830455765702340,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,244846143882963109,15342635759268080394,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12733274111032560234,9443053811999562467,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,10369841247552688917,11556128309212372986,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,6692722194247626368,7321025921205903156,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,6692722194247626368,7321025921205903156,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,14396966721257943907,4619804412585173617,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,16379465767815989691,12643817203778815111,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,8451835506010314056,8273352191429807166,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15731470098883785253,3943638453353592161,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6428,i,10705626166285441474,4495378362745865609,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6588,i,15924078507282091176,15280640370890779177,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6808,i,4538188648126238182,18098290778790290439,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5992,i,14684315381276141974,12963152469114050092,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6056,i,1276850470565662489,8542400594113921663,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5196,i,328578994799181587,11859927201140962241,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5168,i,1521559724025297986,14624285687544992429,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5160,i,14716884043719824709,17295607780041180312,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5064,i,13592589608475987802,10332168822939882927,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5144,i,6956502202054463486,7814187714318290446,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4348,i,14405324911501152094,7399914620600278295,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8164,i,14767877590885182488,14736572462743313165,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8328,i,3469487068557524034,10431419998171247303,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:1
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8476,i,10940217854593352094,5679312088816767131,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8656,i,15484788329371035323,12114718381221226797,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8468,i,1219810122627853342,15235358563947798701,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:1
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8992,i,10793094512890300424,13272661964949419923,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9156,i,2119328708385486282,793457830848965617,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=9132 /prefetch:1
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9284,i,9614238316757315310,15479589611815734231,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9508,i,1325983422867696216,11160417538144802045,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:1
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8532,i,1681550144789529860,2791903668212948933,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9836,i,1810068866261920030,3354074421422089415,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9936,i,18058673470740910907,17980715464665227005,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
      4⤵
      PID:6420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10124,i,5189491685999784227,12668690943666613138,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10268,i,12650491572741673087,11009530734572576976,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10420,i,11559859822180828921,6932836666046636817,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10444 /prefetch:1
      4⤵
      PID:6640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10828,i,9823267608792009519,852812316598563603,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11248,i,6939892193097742313,1879867657619139722,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:1
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11448,i,16645078289463358585,656747888089868393,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11460 /prefetch:1
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11596,i,16177399949694516751,1418509063078390911,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11572 /prefetch:1
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11740,i,8342334530846153196,15382395906664749723,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11752 /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11884,i,1840590267354782167,3270882524719587002,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11956 /prefetch:1
      4⤵
      PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9620,i,9457142014261095735,18078426202216193524,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10552 /prefetch:1
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10772,i,10611207115202449792,8439377708406748146,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10776 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11976,i,12794073299403996802,9458412205098857440,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12028 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12172,i,6934080361160725118,7894422368944644008,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12196 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12376,i,15269766782582573856,17155584966517583061,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12392 /prefetch:1
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12516,i,16459870707105845697,14668115633914656415,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12540 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12704,i,3605792471010611138,15568923773043609795,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12692 /prefetch:1
      4⤵
      PID:7252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12836,i,2447663143255993814,16461745445145378259,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12812 /prefetch:1
      4⤵
      PID:7320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13040,i,13100279965644459602,2372402696733234968,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12980 /prefetch:1
      4⤵
      PID:7392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=13252,i,828964302543009083,15131361872715882028,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=13268 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10756,i,10065271178208924521,16122476653341640173,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=13192 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13688,i,860984888921181382,10546531988784864435,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12836 /prefetch:1
      4⤵
      PID:8016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11996,i,7038688267551231880,11357041160672194424,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=13072 /prefetch:12
      4⤵
      PID:8028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11920,i,7201428392256837411,17258376642155585578,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12360 /prefetch:1
      4⤵
      PID:7764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=12376,i,10745713514227348492,11449728892344763706,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11716 /prefetch:1
      4⤵
      PID:7708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11668,i,6950826901217415181,7058104053959281539,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11680 /prefetch:1
      4⤵
      PID:7868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13396,i,9617877335784488645,16777550582611808679,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11676 /prefetch:14
      4⤵
      PID:7796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12520,i,4394260155409985754,9477332387913961516,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11704 /prefetch:14
      4⤵
      PID:7808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11608,i,5535943924376870711,1073724371504463452,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11696 /prefetch:14
      4⤵
      PID:7816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10764,i,5752099813578130456,17024037522903193428,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=13044 /prefetch:1
      4⤵
      PID:7460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=12912,i,7969894467252313018,5272295997852616574,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=12884 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10220,i,14266180978514426378,17091701742558811163,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8996,i,10061478905095976725,16650070470333003196,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:1
      4⤵
      PID:7712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=11372,i,18098791736784012767,12540532721746168323,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:1
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10744,i,11212076947963424721,13002583379228089464,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10464,i,17368926539928812849,3859049423293861922,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9156,i,7332692613822250098,13089656292635062452,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11940 /prefetch:14
      4⤵
      PID:7352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11360,i,10909458661652397589,3366086747048910183,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11524,i,17513307060796978538,18341165191043884012,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8392,i,9297064044808179071,10625237673130216745,262144 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=11088 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10456,i,17361114269075278086,16290500885068503878,2097152 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:1
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8364,i,12368636935220933830,6571365393012893690,524288 --field-trial-handle=2636,i,6394658165982539798,2182252598862365918,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:14
      4⤵
      PID:7488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4c292b55d0c9fe6aa30709d85fef56041a2e80220164f49b29a1b4b8b2fbb641
MD5 41e03f03db4fefe3aa20bcc40215dc7f
SHA1 1b41af8fa857c0f01bdc7f7712e4bd9fe731706a
SHA512 96a8b0d9e3e61ae9cc424b2a176a2d5b90ea7f8ecea124f7e6f4b99a1b2d3930626fb8e7c002900f5e89e8c402c6f69ec7f13e305476e57956f8ce1e84e37831
SSDEEP 48:5ZhnyOMzPMeaDV8av+lSkPBqH0G+By80AjMya2ZXcDfaCUzUT6rrFJXGujMQN40n:5Q+GaGTIWjMlTaCEUT6XXGKf13
TLSH
T15081DC59C7ADDECDCF90CDB1BCE2CA647ABDDB89428B8F02D4905A3C1942BC448910D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7e98fc4cf80cfc673a234b068c3ff6e3e59f2e83dda80833eedd823427e4f07f
MD5 8b44b16f040ba95b1d6cf35113aad0f2
SHA1 a8bb2c0a15d72fff49fe315733d7e52734f2a7c2
SHA512 36f596d0d2a3c9a10e8405172a09804e51032b0909c35c6fe5baddb3ad989bb54500963acfb479c9bdc3ffb0f32def1a82ea1ef28cd93cf96f1f03e2ec3f6e76
SSDEEP 48:OqZhnyOMzPMeaDV8avw8lokPBqH0G+ByKq0AjMya2+OXcDfaCUzUT6rrFJXGujMk:FQ+GaZ9IzjMVTaCEUT6XXGKf1r
TLSH
T10F91CB19C7BD9ECDCFA0CDB1BCE2CA647EBDCA89429B8E01D8906A7C19427C448910D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 819f63b3bbaf26ed46dc6efbcb0a3bc7d819a37892eeea3e92092105aaaa69fd
MD5 8843c795ee9f0418687e213876269101
SHA1 e2e7fd33b668a36fbf52df95d6198ab8f0d5909d
SHA512 c68f3a5703778d28145805ebe11f2a73ac3e17584a5e658adb208f1f4139a6a1587851e2c76908c311cbab93ff3bdbee42139dde8543c3869025d95916846c4f
SSDEEP 48:HZYnyOMzPMeaDV8av+lSkPBqH0G+By80AjMyaTZXcDfaCUzUT6rrFJXGujMQN401:Hp+GaGTIWjMqTaCEUT6XXGKfRB
TLSH
T14B81CD59C7BDDECCCF90CDB1BDE2CA6079BDDA8942978F02D4906A7C19027C448910D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a9feb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a9feb.TMP
Size 2KB
SHA256 7d23adb047d3301dc0feb246508b7a1060965d7b9bb1fd2e781b8c295f670b58
MD5 57898ad909c4edc840ce21aacfb3f5a9
SHA1 53c1282cdc3fa78a09c6eede16b9321b30611bbd
SHA512 84a7b0435f8dc530b66658b88e87355f4687d8838c5276b859b326592e5d6bd5ff4dbc682d974bdc9a351b65ff2694cf10d0e9dcdf93332138fb5b714f20aee3
TLSH
T172411E5C833CDFCDEBA409B1BCF0C6843ABED8CE0307AE40D4E42ABC4A06B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page_embed_script.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\page_embed_script.js
Size 339B
SHA256 21d28a770a73704374bea8b0eada7e4e4649ea9b85b17a9ba0b01c19e1ae1395
MD5 b48cd7421017288314c168919ee831cc
SHA1 a9cb2dc20a45a469b1adb678a291c61dbd8a86c4
SHA512 78907f01a9d791f834ed2751165d0c732124e308343a4e33eeb799bdd43b9e806fa4b8c657e57390cab66bd85ce4d1983da3acf17a080b67031682d8eaf5c633
TLSH
T1D1E086470F095929F0BE894EEF133A03BB3541106C75954F26CE0051AF433DBD1192BC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 38KB
SHA256 1e808574452bfdc825b62e4857eff111538b00fecbffecddc3428682a730899c
MD5 ee16d304e7caf3f91425d50768d624ea
SHA1 b9e66424b9950a7e6f68b074f4fa62162b8c792d
SHA512 69cabc68e1461f9322bcae6fd07ee06fd16922fb77c383605954dbd4b1c53d8eefc02344bbefc3bda770f35dd05366d0d5d2da96f35bfd4611d7e3a5bae00bf5
SSDEEP 384:Dp8crGn3OKTr8Be28H92Avat8MilL/e3rCKeXkf8B2VatT3aJwfGWxCT3VT7CxKH:kHx2txZzgcEJif15leQe7M
TLSH
T148037AFB87B08A6E8D1159F4AA583F1BCD5D096C036C389A8DE97F4A53E24F0D20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c801887e4bd3541fa4b4f29791013ac04d13f1a8d7fb4c6f16d1b0fe7f84e380
MD5 c3840ddbfb4206b287d731518a8598b9
SHA1 95c878789d567413c9b9f3dd56fbba32dba031d3
SHA512 ab1f81b37da23b91551a18a2d039112d332c1e5cc21ca2a306eea9741753b1dedca7c06cbd5fb48398d34ec142eef66eacd5c40d9073922cd3905950b9df110f
TLSH
T1CD21CDF7C3E8A67D890182F866183F1BCE2D0854832C3D5BC4D4AB5B93E1471E240A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 0e5e52777abb87ce82a240bd49f29d2a5facf2a0ba0aa1ced252611979c11b9b
MD5 72a9cf9cf477b8026e408f05d23405ed
SHA1 739eca0fa8f15e66a3e9173ee3515b4e14e7c2fd
SHA512 4ac5fdde71766673a02f32272187c54ee32ba605a7816fae7bee06f45af54fcc02ca0dba11978c59d8f8c8c1c9d9807946f7f669dc8df9d706e858e3342c2969
SSDEEP 768:sk5re/fuTU/5chveRYKXbryccOIIqASQw:X5rjTqchG4OIIqASF
TLSH
T180C224E3B1381ABA4ADA9436F054F73BD791085699D54EC26AFCCC2C11D7EFDA408C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 c135c195c2e530cf554fd5f5439dadf28c5e564a3fc407ffbcc69f7ff8195368
MD5 537b95288c24b273e47214169c4ea4ff
SHA1 522033135a69871a1d0d4854fd8799133b270036
SHA512 ac5397baaf86b4be368f641f9fd5d03bf6f14ec4697780f2dada7f15f5de41450418e7fa4acf1bb3bb76c0a3f23949084211bf4a8f2baa32ef519c877041a21b
SSDEEP 384:sxRYW8e/fUsGTme+/5G/hveRYKXbryHBwyjymmIqAVFuQrM:skbe/fuTU/5chveRYKXbryHBIIqASQw
TLSH
T1F0C224E3B1381ABA4ADA9436F054F73BD791085699D54EC26AFCCC2C11D7EFD6408C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 31dede8774b866688121a925de2b47d1fc1cbbfb127c176289511d430d7bc922
MD5 68cedadd309a47876ad6e261222f4c20
SHA1 323019fd449a7da86cc9e4cce9d8cfde4a0bd5a5
SHA512 55aaf3496d8b302766b33899327022762480448753eaeb63fb5c1881b88d8a173c2b426be05d8b3b6de2182ed88063fbad6b8ad6b8fd4fe1f10ca2f6e0fb7a88
SSDEEP 192:sxRjR4yM/jK1Ml8wCe/fUscaYZjDzoA8ppq/g6+WN8ZD/Pyu20YrRVaaUIwVITX4:sxRju8e/fUscames/5G/PRYQvVG7rs
TLSH
T1BA72D746A6385D7BCCDBD219F655BF63D2F81522A1900E84AAFCCA1C00E7AED2107C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1ea84d368841aa4fa4b0379988fb03936799af53c412ce1300530e69d6ae4ad9
MD5 19961b2ded76703bb75696328580a779
SHA1 e97fafd075a2b1e7e14096151cae4603dabfdefd
SHA512 5051fb461202326e365085e90a767ed581ed44cf8d62842a1d107ed84268ef069492cd71f9be72d94c0c5affab9963474fc41f484b84b1f3db77a825a54f1f59
SSDEEP 384:sxRYu8e/fUsGames/5G/ipRYKbry9HbmVqAVNj7rO:skze/fua6/5cipRYKbryt4qAH7y
TLSH
T14692A493B1381ABB8DDA8526F154FB2BD3E4042695A44EC1AAFCCD1C11D7EFD6009C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3aed9f89e41097fdb5872c132317408cade2ff3379e79dc250027f76b8c858c0
MD5 7eca0af0d97011493540fdbc110c984b
SHA1 f8ed4b7381842447d8a838309607d2c66d83306f
SHA512 45246d4f387d46feaaa96c21b56689aab48b056d8dde88851f53ca4a89be1a1dc46cff16f1ddf8aa89497432c8e4d9a15efca1ff5f10e734748e4ac32c4e13dd
SSDEEP 768:wGed3v7pLuLzF6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtWOu4Y6roSF8L7:wGed3pEzF6WgoufDMu1jaaWOVYxh7
TLSH
T196E2EA7B680CCB7E4F404EDCEC29BE9EADA801CB5AD88D5447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\007ffb15-e842-4385-879d-65f77678d9aa\index-dir\temp-index
Size 72B
SHA256 a2cc5b75e0e39cc07f2e7dae41c4812e4381284916b49f0ff24ce83947b93efd
MD5 ddeca4a8391fca469aed45ff160ec14d
SHA1 b9af6b4b7e918587bbf8d0058021326bed51eae0
SHA512 11b8b9edc309c4f5a98fef88cb74eba262f47a16ba2f68a39f6ff02b4e6f0fbbb4f471818847d12acfff21a4a4e461bd8d777c4a3b1109517152626137d1a6a9
TLSH
T1A6A002208E854A02DD05437061E74B8E3F598C5211054202E7D21C4489B82C07142601
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\36c991d8-a9fd-41fd-be04-0674f5a6a441\index-dir\the-real-index
Size 72B
SHA256 74971eea8af3bd285ccfdde71a22ffbeb6dfaaba7215a2425abc904e31778c87
MD5 0abfa23fb0c4aba294ad5c82b1136005
SHA1 519e65b38c675d97037bc1803ca854bfdc1129f1
SHA512 34373142c9a091fa88dc729ce2db6969d9b748f23759616369183101eab3eeb6cce3d626da3d7d28fd15855668d2ac4501aea4888065e20d8f29e5ee15142aba
TLSH
T1EBA0023081714203DC1063B430C347D87F018A2823000E46AA9104958D78360B362322
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b3aa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\36c991d8-a9fd-41fd-be04-0674f5a6a441\index-dir\the-real-index~RFe5b3aa4.TMP
Size 48B
SHA256 6a0777d3ad9b34f772821f9b7008dd1b6114eeb3dec19f6b65d23739f78cbd04
MD5 70328fc0fea6c1ec62fc673e9a6bf119
SHA1 5410d07da4dbe34712c8f83b53a51cc50997a740
SHA512 19e5deb85d58d6e9723ec1084a476aaad19e6a18ff9f31d64752d1249a774863830ff87697d4e479fd455660f07d5c894a8ef38c8a3ef9ed49698d9780ca699c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\5bfd68dd-fd12-4832-84f3-163dcd96fc8f\index-dir\the-real-index
Size 72B
SHA256 677698dda166a7f06397e87cac7b1760a3876684f19513283ab509774c014df5
MD5 66e7e36d6d918a0fd6c4b6d9daf30bec
SHA1 59fec16438199b51595b60a280aee3268da67382
SHA512 7bf8df0ab5435927190611cac981d7d49cbb39b1122418aba4d304eff06fa10ec94c7b7dd6f096fc5602c061054e56f080ac3e759b6f38a34c5df5be94f8ca21
TLSH
T1B9A0022585450042DA145772A19723823A208814A0040A36FAB10548CA7F6506141349
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afd8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\5bfd68dd-fd12-4832-84f3-163dcd96fc8f\index-dir\the-real-index~RFe5afd8b.TMP
Size 48B
SHA256 6867b12881e80374587ff40000b84d8384dc7c35f13d2250f85300a2dafe7cc9
MD5 f0357791adc76323b27e7de0593cbf67
SHA1 f7934ed927e892b31843ab646dc9e32a2bd60128
SHA512 7ead6602b0b41a83077aec9cf4323759674c196a9bb8064eeda097eda3de28ca3dfa66bd55eab01c8d948d3293016aa19d0423f2b755bb251044d168d6689f24
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\a551723f-47ec-4de6-a4b7-d23f4c9c2e23\index-dir\the-real-index
Size 72B
SHA256 c5759c5131ec6225a94d3b42be586e64b5787e73a4ea263e9596cfb2e1e35e64
MD5 e1cf612e9af69d1d8f6fa04fd499d296
SHA1 fa3bb1fe199f2be917d75deff0f9a3dbbe126998
SHA512 d2981afd9fd4702f4531b12533de4d3e387297500e6608b1e4026b1b73c2cb3403068aed02647e751341f8bddd38128fb8fa7800f051fcb403792e2c3d0074e6
TLSH
T137A002797A510812D851937120E307807E486850000E1305A6A15949D8783436916713
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b3aa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\a551723f-47ec-4de6-a4b7-d23f4c9c2e23\index-dir\the-real-index~RFe5b3aa4.TMP
Size 48B
SHA256 eb7cd11d4af0f692fe604cf14e37aee9dde3aaabc79b387ea5fd99591901bd01
MD5 9a93bae8c7871f087465a809f5f1261c
SHA1 b110128fc59401fae435b3e3468aea0e61b83f44
SHA512 e1b0382eb2985af81ac509a793478f885b9e24856ce671316ed9956b07eeb3407ec9b336a178d32765628adc14d74c05843a0ae70303cc0a6efc8ca01f33f750
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\c8ff52b3-c2bb-43f2-8de5-8a7b9381a7bf\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\e627e9b5-f7d4-4fbc-ad5d-e79fd3a0798d\index-dir\the-real-index
Size 72B
SHA256 298ca10163ab85a1f7b0c97252c26b524bde4591e20a078ad624273aaa3abcca
MD5 a74863ad9dfd70468e1c940138b000e5
SHA1 0116dea23cd3fc9d2136d04624a566fec1136e68
SHA512 54a861665d26be33954f6a58de18168bd569e29466a4dcc20b0ec6b180953586da45bfbdc6cb980f3f2e028fbdfeeb558fad9a8a9ad077a38f8f323031b6a731
TLSH
T144A0023049605617D9004B7010E303803A144E2513A6D60AA6A44049C8793507122211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a84e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\e627e9b5-f7d4-4fbc-ad5d-e79fd3a0798d\index-dir\the-real-index~RFe5a84e1.TMP
Size 48B
SHA256 69f3055ba8e20faa2cf5b353a3ff3bbefd2d74d1b647c20bba3fa5ff9ede9a70
MD5 b7153d12bc9f2bbd94cf983ce8b853c5
SHA1 4fe697b8baa5ee162b20279a2ef6ac77c6d3561f
SHA512 307bd9d96dd2f3cb41e4d9cca62ab566e9139fd13d8a5cbc3abf4016b6f2572015ced6efbde975b9d6eda0aaab5e9356eedf1f4f3198254b268b43938b776b2a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 164B
SHA256 d2db32151c67d11a367325350b3e24e924b2a6963d6a2aa71afd83bfcb8e85a1
MD5 dde34c3fe53a7d3d65e8fdee98553c20
SHA1 8820efeb948a8581d0047929f809087f9c091e8b
SHA512 32fbd4f7c04d4cb9cb53d892b307db37dc9f3d6f657a2e1b8af4e42c6d6d23f42d3ed6bf4d95227e1cbd71765a4ef6588dbdbf49b51a8be5125249a4d98ddf5b
TLSH
T1D5C08C9A2B7B08243A0003AB0564B956EE1CAFB66C40C89BA50632002F3422F8F438F1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 161B
SHA256 6ffff7f285afd1a50e42cb33321eb6b52e9bea0de5cc7b62a7c21c75ee9e0ffc
MD5 bdc4ee645bd162b3ba9448fd30ff6ead
SHA1 c61f78f8e3cac380039ddd34731c3371cbc3e062
SHA512 9a055c99642ec0969db419be0d2cd6ab3cb9e111ce1f763b90c0b46ecbdc32a9852968b66789be477a732cb3778adc8d1c2409b5698937a2eea3ef8a22e47e91
TLSH
T17EC080611BA205186950179F44441046E71A1ED17C10D43A590435043B3901BC7D3CF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 161B
SHA256 c2a5ce0dd8a81af09c77beb90f6bd06da2c64f5ca2fc3bf9d336970d4936ba0f
MD5 23cf40a15ff55b4842e07caf9ef0697e
SHA1 8e8dda98cef7b3a82556ab12ca6f1b796c607d56
SHA512 f95048fe88bbdb79e1e98852f1e32e98e20dba402431bb70d21db184dec1e16c2e8728d1a49704f1e22ab70b4b05328cc73604bebd7f4a0f48e5383772c4d3a7
TLSH
T144C08C230AB426C0A6504687C4441844AF3A1FA5BCC0DC26B1083440AF380A382CBDF6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 158B
SHA256 e13ea73c4df268aaa10e133b9184799105cfed66179cc99049cd62639c9777a9
MD5 e15af11119a2c1d6e61fe4005b46b4ab
SHA1 ae9bd5eef01346052fe8165bf5c61218ed752fd1
SHA512 70638c505d0af5664284840fab6e3d1f480a233050eb22ae22151e7d7b1f54718616733f60d2ee05399491a924ac8a1a01990bcf83abd77dd959b61a86286a28
TLSH
T190C08C320FBA6A002A20025F80042901FE1A2DE39C40DCEA6A0938403E3301BD11BCF4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 161B
SHA256 469cf54706107bb2ac9c0d4bb60327c4ee1f96ee20e123e9f0cfd7af0cb21adb
MD5 757d3bc71d68dd610f27261b58d7b3ba
SHA1 ffee5d47d4e2ebf76a3c490d747a4a51357d8742
SHA512 f38954286a85d780343dba851747ee0e6ccd03240052ad34b5839f0135171a9fcf800c2f2a2b81e6d6ef2eca14ce0acd878df764627bb895a4b07a4eb9a88445
TLSH
T1F6C080324BEC14081E51074710451115EE176DED7C42D44B440D75013F7146387434F1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 158B
SHA256 b70acb5dd46306919fb138b5ea660412672e61d4586f63c35ba23f8658531b36
MD5 0a44a6fa4b2c36478049fbad6c98eb03
SHA1 e59f1241bfd303fa7d2034fa40696658ff7d6e2e
SHA512 53851d07df0c5a669e7d14440bed33d0a1163f54ed7a01b51719297b10ad1df7ec914d0ac09fca833f5ec9f8bcaa6fe6144016924174a75742f8576a71e3f7e1
TLSH
T138C08C535FB918456E8102DB40003C99EA1A2D94BC80C8D2A48C34C27B74013861BAF7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 161B
SHA256 3eabcb2375539fc511b68413d63d879116ef72d8b5b956011ab1295a4bdbbe40
MD5 76a5a079e3f92466ac1faf42f61fb4a0
SHA1 47c547dd0bde3803aa846e7ea9b45e3e149e336c
SHA512 f89a5d32b4fc88dc9354859b27b54487a2a160a186fb50df60f365fcef05cfc14d98b16ae2f446afb9fd48b9b07f511db9b08516fcb30aa50b0572bb85c9d400
TLSH
T111C08C220BB10D002B1442A700183A0CBA4B1DA8AC40E86A290075C13A7501B6B07CB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 244B
SHA256 3647c71c3e4cd4f05fc711d9497c3614d5d9b719876631586cc63fb3c0d3c525
MD5 599989762fa677279fe571a026b4abd3
SHA1 7bd2d3ff1b0c000fcf89afca4213824e55421e20
SHA512 f22cfc8e31302ea0277d1cad38c163b67725a9fad8835f43672797d0ecb2f6becad3b57c6a0a4ce76c942e05132bc12f6e175e162332187fbab3c0d5fa8feff8
TLSH
T14CD0976A0B2E08052F245FA30808590AAB028EC7FC40D102E0043900BF3A407E493CF3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 151B
SHA256 d836e096421c5735859ffbd5c1316fc16dbbc8f60b4f2b2d57447ed13d732c34
MD5 89a869e54ebf7790ea9b2fae2d33ea16
SHA1 581427b6265872b4be8b895807f5aba624f04f52
SHA512 9ea68c724beb67ed7f790474192529581f48bd738e5f083ae8e2159a41dd6030c3fc55501310e50f900f981156e3ce2a0a6aa6ab4d5a4baa8689491c3d2974db
TLSH
T1AEC08C2A0B6E58002AA49BAA18489814EB0216E5AC40D406F0081400AE1D0068997CF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt
Size 68B
SHA256 30d4fb165ccee8ebc3d6dba806d20fdc2435c6c4c19f64fe4eaa97ba5c7e2c1f
MD5 923d406f6d2908dbb8dce16d6fb21534
SHA1 ae4f401056d6f9e333fff491d5df98496d86d5d3
SHA512 7d3fba6bf4e8a82d7ff80359468b9cf528314d36efcd47a18018e08911e2e009d57eadf41bdf7b1da4355e595c82064cd207cda1a59008a71fa648ee3ba74a0b
TLSH
T1DDA002B70FBA0D402E2003EB04082819FF062AE8FC80ECAB960828403F0802B8A03CF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59bdc8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4ffb7358a29bc761e609ebe050ead92abd4d116\index.txt~RFe59bdc8.TMP
Size 161B
SHA256 10c5a74a14fefdb0320aecc9b83859b888141ddca488e936ff97b82dcee5d4b4
MD5 6c990e6f7f7e9b5c831b55f73874e1f2
SHA1 c08da539b2f04210be60a28fd2f366fc31c8510c
SHA512 4fc215c7edef293ee54b1ebe00272f740f5491f9096663cd5e9cf83afba3b4882402254aa9d5873ab0d6d4fe8896da058824d06589449f49450bf72f7ff0f46f
TLSH
T10EC08CAB2F7608011F1006874818294BFBA59EC7F880C56740043C142B36A0BA603CF3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d8ef0ea127a6e27436bf4113ad09702444da5cb0bc75129195038abab267536
MD5 69e6c9fa02bc499233fc1b691602a59e
SHA1 18b9990ba972928d76e380b933bf917e5466da1f
SHA512 1c81bc5aeb2da4b789dded7a5df320d33f6d267dd1d11a005e07a2ab14b0e5ce358650dbcd5cac6c4586399375b09fbd507315d05a87adcde491cf9e37cf897f
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm34:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhs
TLSH
T1A891F545717E02403D7E6A0981F99C1AA3C178E13554B42F7BE942E64F66F038EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4efc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4efc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f6e185bdf62df5df5e6d829e1c7018e887d93561f484bde4008872fff24743a7
MD5 d7e269f8c00e831007d172c9fe81e385
SHA1 306cca6ec149d19b46d4a62a42bc5dbd6a6331fb
SHA512 0d342491e022042a7e758eca818e6a097d979247ae4d62a9071b92d10ebb8c5833323e7c96ae88e7847f6a9ecf02476029096613e31773bc3f463ca6617cf813
SSDEEP 768:6rv+4UNbds3QPDZIO0W/Nzc4ReyIsXCeVH1S5D:6bsbS3Wtc44bsSEH1Y
TLSH
T1C603BE32E8788977ACE66785B54B76133EF8912782981B90C9DE2F0C4A4B1DD131F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5c7aae314d25aaf0153cd2130eeb0e5796b5322c6c0c6fef7f52b66ff646c7fb
MD5 e972cc14bc70bcdf3fdc9148ab29cea9
SHA1 95417ac2ece3362d36d3d56fa6fe685e9b82a06f
SHA512 6a9a62855cc7482cfad31b9e9151a3dd3bfefffeb04a9643bb700a4cb6cd4c81051591e24b225da4330b31d3540498e70a3e8f1022dc35307117c0e92365aabd
SSDEEP 384:nn/ZcIu38NAM7q4fhCJDZNfNoXOVSUUWXnFLXoabRbETRzcoXfK86sfxEZxxsIjO:Xu3+3WDZIO0WhTN4Nzc4ReyIsPUOURW
TLSH
T190F2BF71A835DC63ECEA6746B6067693BEF9513784C85E84DAE88F1C05032AE175FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 23abdeed5078fe722929eb32e1bdbdaf6fe0eb74b4676eac8a3259d0e955d349
MD5 f2284df303583593ba2dd8b527801b74
SHA1 c1fc1f6a611732d888fefe9a1ba7a928c4fe464d
SHA512 be42e206dd28b5ab9c78843e3e57d34ff0d9feb533a74376dae042cf02259ee54d2f37a8253b61fd1e7e106abd5b0c25a08c8c0924eb95293d40065449ad26bd
SSDEEP 768:grv+4UNbds3TgDZIO0WhTuNzc4ReyIs2UeVH1S5D:gbsbS3Uutc44bsbEH1Y
TLSH
T1E903BE32A838DD33ACEA6785B14776937EF8612B81850E80C9E95F4C4A472DE175FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5d2ec670a42a50610916d2350ff50d063f8627192ac38b5f6fdfaf8069ee8f90
MD5 07fa2dcbc2d30668fcfab5b64f960393
SHA1 5876cbc8c584947a8d0304b183e9bb6213b8657a
SHA512 916cfd574a7f3ac2a6469be4f12a7430e3536b7af00b69ed0ed46b1889510ee868e2580cc9a41fa0d8df832e081f5fa30251081c5ba22bebc658727e5a1c40fe
SSDEEP 768:Yrv+4UNbdF3ztWDZIO0WhT04Nzc4ReyIsPUeU:Ybsb/38dtc44bss5
TLSH
T19B03AE31F828DD63ACEA6685F50B36937EF8202784C51E94CAE95B4C49072DE175FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9e706c66506f43e992417a08a8b72aa0154b9491caf52cd5cc84fa2f921f0214
MD5 e1892612752b6929ea55e58f9269e2b7
SHA1 c9a933809005a0e956281e0ec75bd66630e9908a
SHA512 38f4376d54675d1deee9dc5254b920702728e36e15186b025cf066f0a0cc9a75cb3f8078c35489e913425e17b777fec19a4d04dcb09b2b5d94675e902c653821
SSDEEP 384:niZcIu38NAf7q4fhCJDZNfNoXOVSUUWXnFLXoabRbETRzcoXfK86sfxEZxxsIj4h:Qu3N3WDZIO0WhTN4Nzc4ReyIsPUOURW
TLSH
T150F2BE71A835DC63ACEA6746B6063693BEF9513784C85E84DAE88F1C05032AE175FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ece1d770-5f86-40a7-bdf5-b704041d1788.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ece1d770-5f86-40a7-bdf5-b704041d1788.tmp
Size 42KB
SHA256 27bda6af593af3ace9d677df1532f19f864244d6e5243c0360cf3d20be89d324
MD5 94b80bb3720d141746de1d37d6d155f9
SHA1 a8e17acfa7e7f474f222731f7f98230428e1a720
SHA512 9a29b7f1d340666c5a47520fc5d52efc6f31bc517528f797533119631c13d9548a50ddff2e9c88624ab816dbf764460c2284dc1f279b77d74d7f7064936b8db4
SSDEEP 768:mFQ63DwgyCXZQ5O0WhTxENzc4ReyIsPUOURW:t63L+tc44bssOURW
TLSH
T1941306F198E78976E8AE5787A73D6D42A9FCC163B5885984B7D84D0CCC421BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

b494f29d-9524-41a9-947b-e9a8ab20ada5.tmp

Path C:\Users\Admin\AppData\Local\Temp\b494f29d-9524-41a9-947b-e9a8ab20ada5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4064_531308328\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download