hxxp://openrouter[.]com

Analysis

user interaction
yes
max time kernel
845s
max time network
819s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://openrouter.com
Sample260825-xycfwayamd

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	283	[email protected]	2440	msedge.exe	29
Email address	283	[email protected]	2440	msedge.exe	31

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2440	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321589288386843"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{C33352D5-6749-403B-8C38-C255A4E1B49B}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4900	4948	msedge.exe	85
PID 4948 wrote to memory of 3940	4948	msedge.exe	87
PID 4948 wrote to memory of 2440	4948	msedge.exe	88
PID 4948 wrote to memory of 3940	4948	msedge.exe	87
PID 4948 wrote to memory of 3940	4948	msedge.exe	87
PID 4948 wrote to memory of 2308	4948	msedge.exe	89
PID 4948 wrote to memory of 2308	4948	msedge.exe	89
PID 4948 wrote to memory of 4628	4948	msedge.exe	90
PID 4948 wrote to memory of 4628	4948	msedge.exe	90
PID 4948 wrote to memory of 4628	4948	msedge.exe	90
PID 4948 wrote to memory of 3184	4948	msedge.exe	91
PID 4948 wrote to memory of 3184	4948	msedge.exe	91
PID 4948 wrote to memory of 3184	4948	msedge.exe	91
PID 4948 wrote to memory of 3732	4948	msedge.exe	92
PID 4948 wrote to memory of 3732	4948	msedge.exe	92
PID 4948 wrote to memory of 3732	4948	msedge.exe	92
PID 4948 wrote to memory of 4740	4948	msedge.exe	93
PID 4948 wrote to memory of 4740	4948	msedge.exe	93
PID 4948 wrote to memory of 4740	4948	msedge.exe	93
PID 4948 wrote to memory of 2552	4948	msedge.exe	97
PID 4948 wrote to memory of 2552	4948	msedge.exe	97
PID 4948 wrote to memory of 2552	4948	msedge.exe	97
PID 4948 wrote to memory of 4828	4948	msedge.exe	98
PID 4948 wrote to memory of 4828	4948	msedge.exe	98
PID 4948 wrote to memory of 4888	4948	msedge.exe	99
PID 4948 wrote to memory of 4888	4948	msedge.exe	99
PID 4948 wrote to memory of 1796	4948	msedge.exe	101
PID 4948 wrote to memory of 4388	4948	msedge.exe	103
PID 4948 wrote to memory of 4388	4948	msedge.exe	103
PID 4948 wrote to memory of 4388	4948	msedge.exe	103
PID 4948 wrote to memory of 4680	4948	msedge.exe	106
PID 4948 wrote to memory of 5024	4948	msedge.exe	107
PID 4948 wrote to memory of 3400	4948	msedge.exe	108
PID 4948 wrote to memory of 2344	4948	msedge.exe	109
PID 4948 wrote to memory of 2344	4948	msedge.exe	109
PID 4948 wrote to memory of 2344	4948	msedge.exe	109
PID 4948 wrote to memory of 2812	4948	msedge.exe	111
PID 4948 wrote to memory of 2812	4948	msedge.exe	111
PID 4948 wrote to memory of 2812	4948	msedge.exe	111
PID 4948 wrote to memory of 3772	4948	msedge.exe	112
PID 4948 wrote to memory of 3772	4948	msedge.exe	112
PID 4948 wrote to memory of 3772	4948	msedge.exe	112
PID 4948 wrote to memory of 2396	4948	msedge.exe	113
PID 4948 wrote to memory of 2396	4948	msedge.exe	113
PID 4948 wrote to memory of 2396	4948	msedge.exe	113
PID 4948 wrote to memory of 1180	4948	msedge.exe	114
PID 4948 wrote to memory of 1180	4948	msedge.exe	114
PID 4948 wrote to memory of 1180	4948	msedge.exe	114
PID 4948 wrote to memory of 1116	4948	msedge.exe	115
PID 4948 wrote to memory of 1116	4948	msedge.exe	115
PID 4948 wrote to memory of 1116	4948	msedge.exe	115
PID 4948 wrote to memory of 2124	4948	msedge.exe	116
PID 4948 wrote to memory of 2124	4948	msedge.exe	116
PID 4948 wrote to memory of 2124	4948	msedge.exe	116
PID 4948 wrote to memory of 5836	4948	msedge.exe	124
PID 4948 wrote to memory of 5836	4948	msedge.exe	124
PID 4948 wrote to memory of 6032	4948	msedge.exe	126
PID 4948 wrote to memory of 6032	4948	msedge.exe	126
PID 4948 wrote to memory of 5580	4948	msedge.exe	127
PID 4948 wrote to memory of 5580	4948	msedge.exe	127
PID 4948 wrote to memory of 5580	4948	msedge.exe	127
PID 4948 wrote to memory of 4732	4948	msedge.exe	128
PID 4948 wrote to memory of 4732	4948	msedge.exe	128
PID 4948 wrote to memory of 4732	4948	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://openrouter.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ff81618c188,0x7ff81618c194,0x7ff81618c1a0
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,9854420605019156935,12640507960924139820,262144 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,12152004714073592616,10280409013028967707,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,5009413329321778876,12214459180443474755,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,6497864236210096181,1321240676745902135,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10600946787934475712,9761590080135961172,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,1663245299457407471,4459965363633368540,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,13572849885480151920,4101609067201957700,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3580,i,5239669960307175531,14763433945588556897,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,14972482556980559346,15653096307185666008,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4674703927086259677,5931517808577426852,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13314938040514948186,16780600747433483648,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13314938040514948186,16780600747433483648,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4300,i,7650612777518117722,1243914340576289957,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,17732863575458307209,17012478607524456892,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,9961716080615804445,7779382771449449681,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10279464975025810045,16339758690287528887,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6592,i,6879131660614380591,1614554229531501828,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6492,i,15605233856144947282,8425437025691483333,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5132,i,3142918898468914893,13175069213931496105,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6928,i,5792145140195998182,9534311347254080803,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3468,i,17368173337076183739,16669674658307879663,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7172,i,1270354078963131534,1038083399818270069,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7332,i,12422788719801019189,8534739340199048222,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,1410754248630547892,4393726108401962607,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,5618330251989073818,13444239460302401868,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5272,i,10185903207698252962,5839086228358975032,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5508,i,1482999231785220666,16135154402312692945,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6996,i,1129279671437091494,11217264909278324218,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7384,i,2491157507903625951,907817883337531686,262144 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8088,i,12607873438965350763,2507624190434558309,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7996,i,8661610220144663903,5475134008741404319,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8048,i,12151569356716719865,3829573376988219796,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8000,i,4556169134288699324,3558901985860987361,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6748,i,6687152424582201487,14689642405800890387,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8044,i,13527220279888015079,8807476961668554054,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8032,i,14979527711524123813,1679818872393147480,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8992,i,5536185692570236037,6972445346896602537,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7644,i,14813156744841518538,16591745170038921567,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8376,i,18109781199920177138,18258229255400846586,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8012,i,2397442226306310226,15211512223767610322,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9260,i,8992421261670673,12820002836253012269,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9708,i,15648951746383043944,8695706797347796902,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9848,i,11226512538635223837,12497258687050504828,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9980,i,14572071032156469544,8280018093757388820,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10008,i,339592384978860788,16097795306553825616,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10040,i,14355285513604142416,15447419034423772775,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10052,i,10334210293312597732,787840093702461213,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10020,i,1806277262482795514,15908789937757125187,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8436,i,18348152038172765011,2911021125876997006,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10588 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10892,i,13782131348216925279,3181206941876834017,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8752,i,6029851857379759772,5282295094994672760,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10880 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5560,i,2639409296344779708,3192431455478050685,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=1040,i,14064302716400338347,9828971244446368655,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=10752 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=11320,i,14677635341813190735,4627839074026190873,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11272 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=11452,i,1434573054264390646,3665004002556940253,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11328 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=11576,i,8942237879350470100,11844987038365366649,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11632 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11656,i,13241604828262832663,6643451069768901267,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11648 /prefetch:1
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11984,i,1357969872304639400,16523517962763584502,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11940 /prefetch:1
  2⤵
  PID:6380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=11436,i,5789590725489565161,883354490611891101,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12084 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=12236,i,14655090603787869620,16659558465362588398,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12232 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=12396,i,3372225342713088115,7073197345622228425,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12416 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=12608,i,8033334773405076085,3771640222078275066,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12548 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=12740,i,7493249629728251644,2475675218407805649,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12588 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11996,i,7032499204534429377,11331732587503257168,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12920 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=13012,i,7320528139641761416,14476678462861121358,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12748 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=12644,i,2438703490786165213,4525499639064005606,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11892 /prefetch:1
  2⤵
  PID:6840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=12080,i,4115441307808973322,14490524891933261848,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11624 /prefetch:1
  2⤵
  PID:6908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11792,i,3798749029002271210,5902214689120042542,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12736 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=13412,i,15051761471875973206,12482887003396717559,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13512 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=13704,i,6212872506777544707,13404533795902675167,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13500 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=13708,i,6303785987718021664,7831507587627889066,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13696 /prefetch:1
  2⤵
  PID:7100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=13760,i,11143965477458676652,1409049605579034041,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=14028 /prefetch:1
  2⤵
  PID:7188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=12228,i,8422918625840384592,8158778105020122549,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=14032 /prefetch:1
  2⤵
  PID:7196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14020,i,12726871432017109794,14750154356791977724,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=14044 /prefetch:1
  2⤵
  PID:7204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10748,i,13318404912532561706,739586857505737958,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11292 /prefetch:1
  2⤵
  PID:7544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=11340,i,5929359563259535785,11287019300394981235,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
  2⤵
  PID:7556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=14120,i,193655143750220034,1467045478347292986,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=14112 /prefetch:1
  2⤵
  PID:7684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=14236,i,6469283603298587843,14597550766323118953,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12020 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=12016,i,2044704094067299528,10591414890022233378,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11896 /prefetch:1
  2⤵
  PID:7748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=13724,i,16804239694284571424,7696634107363849309,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13940 /prefetch:1
  2⤵
  PID:7784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=13196,i,16345237491579568678,7789717010052005602,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13948 /prefetch:1
  2⤵
  PID:7824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=12192,i,10385998581234650452,9809441302424314470,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13128 /prefetch:1
  2⤵
  PID:7832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=12184,i,16192410727123952733,18150749281501464038,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11300 /prefetch:1
  2⤵
  PID:7840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=12924,i,16509165338395048692,18321946179841567374,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12360 /prefetch:1
  2⤵
  PID:7848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=12852,i,10357558522211265008,1055784890226470999,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12928 /prefetch:1
  2⤵
  PID:7856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=14236,i,9349548864194988717,14415750322467451414,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11780 /prefetch:1
  2⤵
  PID:8160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=12536,i,15780666289783574157,9732497139285673901,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12484 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12840,i,15765440888884100793,4348906915612575739,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=12524 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13024,i,1310978064521185566,17950674542553880447,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11316 /prefetch:8
  2⤵
  PID:7068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12408,i,3055920671109804672,1376855560088825222,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=11928 /prefetch:8
  2⤵
  PID:7300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=12984,i,14820044225657753032,1654241639977165701,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13124 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=13480,i,5443134081750339790,14433351698921434601,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13200 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13972,i,2858492444634817853,7068651359038174150,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:8
  2⤵
  PID:7644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8424,i,293885828000842396,15576001040287452901,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:8104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=11412,i,11192460549563406723,250173100598209243,2097152 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=14124 /prefetch:1
  2⤵
  PID:7908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,12759538842935619177,11577507121585558397,524288 --field-trial-handle=2332,i,2581211895335963280,12212059458637766468,262144 --variations-seed-version --mojo-platform-channel-handle=13156 /prefetch:8
  2⤵
  PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 62aac6344b45de16b2049ca4d9c2410f12719a1bed8a8767c244978f960bc0ae
MD5 13810c9bb0e350475efff61afd482c6c
SHA1 b931ec0aead5a942752a32a6bf5f605bc79c0a9b
SHA512 e2c25144c68b178aa003e9ce78209e0953a690e17212a1d6db72e0542c8b2aee976dcc97f5439cab636b59149c29d76e21b1f2c0ea2b1b27392b0eb7bc452c38
TLSH
T19EE07DC415CBC3AEAA4468CB53F8C34C92A0364BD6C8AE1B37008D8CB403458F7C66B1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 18b4252de2b3ef0d9b10fe5dd8ecc83a2d627f5e93e7343025c5c2d316d9055e
MD5 41cb4c33ab06a83b310e2a92721842f2
SHA1 5c87984768bf31ee72c8f08717f071c9b03ea8e7
SHA512 b7ad9dbf96bbd39fd7971ad0d4b72011ed60e39cc52c1e42b439422024fd412b5b9391eef20add8deaef1bdb9043f98a62f86396844815ad25d08592bab2a3bc
TLSH
T13EE020D405C4D31DFD40688B53B4930C83903B1A92C4BA251B048C5DB4415506783D70
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ac5ce5d1b73f897d1f162f3f638accf5417dc3dc8e4157f6f7bd617e804aef1f
MD5 0518f30df0ebdd251e7f92071b4fa85b
SHA1 b06b2f23382b85c239206c4a38681665d3c63202
SHA512 94e76ff6aa6f5b2940429f57d1c703825a52a5ee908cc0582f8e1ff8c07ffb201560d34bc0fe8df154332870c73536a0097a8b8f79c0c48a69e5f5222aa9d660
TLSH
T10FE026E41ECAC36EAA4065C7A3B8C30C8380360A93C8BD1A6700CC887441459E7C36B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 49KB
SHA256 59eb1896e0d6bf1b85181a071098f3336c5fc59ebe075c9ccd3b0436bde54588
MD5 fb0a040a1d40ff9083735889072c41f6
SHA1 24a2e1c9b1176a5de5e0067683cf4b657ef652d8
SHA512 ac82c34ceff966e8a0b893e7ad4ae7eb504af9f47fc9fc67402e6e51604a4fd05deaa3db280a456e2e4e18ed896e162b49262b3b0b0b2d1cfc32a99c65617f24
SSDEEP 768:BS1dnmCnmsfkO6eFuO+8JnoKqkdT2W1FS+Sh:wXfkO6eIO+IoKziW1Zm
TLSH
T1A1339CA7C70658E3C46D9B764A574F30F771117282960F6B4F3CD1AC79A324A2F27A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000116

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000116
Size 456KB
SHA256 3496c75fec52572fc7bbf2cdb2fc03db3d6088d3292b8403d90fd0c664a50a2a
MD5 060355efa72c6b3f783cf9f22236ef86
SHA1 8df248c1e4257d96ec54a0a3ea94612ba0a3a1b2
SHA512 ae4018aec351de316f4f756fb5fdbe5dc60f2e9939d72e83843335c4842885814d13d1e881aacc99143c4cea597ed51e2e165cba116ceaf471350bc03c975215
SSDEEP 12288:AM/RsZ5bF1A1AVfFTcYbxY9MtKIXVVKZd9MGY0we:l/RIIoFTcsxayKISee
TLSH
T14BA423C4B1C22596BA6BCC9075C3AFD11B62F2BD3AAC1954437D20FC5D840BE7226E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bba7b594bd93f5e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4bba7b594bd93f5e_0
Size 14KB
SHA256 9b3fa8a0908454c92c0047b13096c426efac7cd953ebab21f377de1a78fa992e
MD5 a415c89e9762ff8fe1bfd7989e0a0138
SHA1 8e1f9697f745fd6c99935bdf42e6ee789c161c32
SHA512 c93f290617961620ec55b554224294abd8b42966f7534bcc91facbcb812dcf171f36d87a74f2ea1940870a6dae80653f4f569d7b8a3ff582a8f706d9cdbc8889
SSDEEP 192:zEgvGuDzJ1xHtCwzuBxML6aRg44DtqXISGgftftQvoB4/DfQe9xQvWCd0BV:z39HtC+O+BfKtq4SXtmvW4/DfDet0BV
TLSH
T1906296916B90EA49CF2763F90A428D66B338409C3BD3D71330E4B7291C192EB5D89E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 e4e4944157699f84d85950d2896b1481c4ec7a63951b49c0d406840a8bebf3e9
MD5 f1dcf40b269ebe25bbfdf3a075dfea6f
SHA1 6f9e78a2178a73c9fad1cec63d771ee44455e877
SHA512 6a9e36a9dddb7dde7cf1de668b0800108d7ee7ca1a70a6346000e7b1fd0a6507d08a7236b204d87ef89b97f71c4e7fcd054105e3dc55f876cfdbdebbade9b114
SSDEEP 192:0z3TUZaO9+gsO1vg1g3bM6479d6/LsnX2D6YqF4A96TYFUcSgpzIo49A:MSx1oWh4RdWUHpp6A
TLSH
T11412EB32128B425CD7502EB712D20DA8343893D4BB932F6B47D756B1E137BA228A96CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 68c0cefeea163995b6e96d67c0ea7652b75adbf173b3ce22cc0d416539209f5a
MD5 e495400b19a6b5d81c2bcacf069adbda
SHA1 d598bcf980134d9d17e5c8073eaad6d70662be00
SHA512 5a731c4c276f2c1044d19dbac5133ee6c54a6ea4a3329ada9c2ad27a1125fe65dd765d579cba0ca1412531be84dff89fc9e11fd336228e95ffc0df77a7e28727
SSDEEP 192:0z3TUZaO9+a1vg1g3bM6479d6/LsnX2D6YqF4A96TYFUcSgpzIo44:MS51oWh4RdWUHppz
TLSH
T16612FB32128B425CD7502EB716D20E68343893D4FB932F6B47D756B1E137BA22CA96CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 fcedf1a912627efe2528a7141cc37d9f07e1734665a7c82a92a9234c1510e758
MD5 b429711cd347051e444053b7b93bc9b5
SHA1 4a3f1cdc7cbe5604175ea805ca761df140bc8a0a
SHA512 02885209c93110298279eae64184a05fa5d0a2decf10faf7a6b48b7f5f2d820caff63f716ac32646de31ad39fcb511172f64cf93ca222aa3962e1a8d96fc30d8
SSDEEP 192:3Bz3bUZaO9+gsO1vgNg3xM64ak9dL/hsnOc2D6YqFVJ9kTYAUTOgpzBo4V:3/Sx1oeP4/drSt1pT
TLSH
T1C222FB32128F425CD7502EB712E20EA8343893D4BB532F6B47D752B1E137BA26C696CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 4477d6e17600e73228242f59c780acaa053f5abb0e51c96ecdea772f6001e086
MD5 969ebde16c771a323ea1a96c957871e8
SHA1 eae6f8d6f25f4d07d2da33c29f5507b10e9b370c
SHA512 ac8d8afd5d8c69b4335d1f09a015ccb01b0ba5bed652bdae4fe15350f20450933ef6ee7052f5b0a87e4c8f3a18eb147f9a2ae422e8e9e4c42ef779ff7e4a19ad
SSDEEP 384:DYt1Q4THkzmDAmvRx/MmgeJUKJCIVBeBsJZz2Ve8J413danVZfnInuq6G3jMJD4H:mxZutjZcRlE+X
TLSH
T16C927BBAC3E5CB2DCD1259F05A156E1BCD190929036C3C1B89D9EF8BA3E24B2E14574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 f10486b97b9c5672e703db612890985db70038bd305797daa4aca3c0736cadbd
MD5 dfb9f860d6e3743d71b18bfc9a455a0d
SHA1 65fef2d767c044f5e97df382409e704895695813
SHA512 eade1c21c575b7f22af4a5d65c48067eb9c4b7e78b64b1c65a41855a27eba7a5c4fd6a774f70039069cd6b047a57641fba75c24b97174f78bb8bd840c2def6d9
SSDEEP 384:DWQuGLhuMeYOcWDLiDv+eWPTJhJ0BeZ+JuUVgecJ9MeyHsNUIJfmITyM/Fz13daN:K6PSuDP6K8RnxTBS
TLSH
T104F29DFB83F08B2DDD1659F05A169E1BCD29043803AC782786D9EE9793E24A3D14674F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 39KB
SHA256 3153c52e959f791a96da4db843d9cc77d9cff17882ad4723e4655d04423ee056
MD5 ed1aad462cc44eb8cb6640ff6dcf34f9
SHA1 1151c9bfec4fc7ced07c006000136186471846d4
SHA512 d800b37f22c59a89e6e39f7328ac06622bf26cb3b16aefcda0b7c513db8050804fb90ed791483c4324cffb3d9958c5799067d0fc78888aa9967444414b8e0910
SSDEEP 384:DW+QuGLhuMeYOcWDLiMvgekUKJCIVBeBsJZz2Ve8JKsTqTsNUIJfmITyM/d13dau:MxZu6DPpTlYY2Ppn
TLSH
T135039EFB83E08B2DDD1659F05A169E1BCD19083813AC782786D9EE8793E24B3D14674F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 af8e6ca3baddedf72eb37578497a7c4db2149e3aa4cd42df103239bd9a70521e
MD5 0cb662b7091efd05ece42f8b8b8ad8ca
SHA1 81452d5d3e1c185a8ea3170ee85b7c8dbb3e7470
SHA512 be0767c38a40ef1a92d7524e232e53536c9b62e492929ee1064d10ad027120d57a20c9f5471db7a8e961e9869a8e53c307d95cda84164496e02c02878ab54428
SSDEEP 192:sxZIRGkH/fcsZzhvovIdpCRQq0bHW6+WNJRAE/YCk+rovIgrJ:sxZI3H/fcsZzhvoAxHbL//u9
TLSH
T19A22C8526E2869374CC7D219FB19BF13D6F91432A1D11E4CEAFC961C04E7ADD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8213586941fb010dea351510373498f8e4273300862188cf4f19778c79a1f910
MD5 d075f83d732b8ad43d12ec073892bf30
SHA1 259156a6639d94aa5c884bf5da94db3f0ed288aa
SHA512 625d1f855d6819162b5ef8d818fe41900c9ba5e9c8a2a0158a0225740617bf6e215a48f374c02a334b38cd53076a104f7589fbeb14a2f8831f23216817007e27
SSDEEP 192:sxZWRNkH/fcstzhQoCKNba4cddpERQqO+0bKHW6+WNFaRWiRX0BJv/YC2zrovIgx:sxZWYH/fcstzhQoCKs4mqHbj7T/Uux
TLSH
T1BF52E75269242D7B8CC3D619FA15BB13E6F90422D5D12E4DE7FC9A1C04E6BDD220B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 f0e49877d8cf526d61a46b254c171ad23205d6f838504918ea9b8ff39cdfdeff
MD5 ee66e1f4c5ed1a6ba09c0857edd3c250
SHA1 590234d4e1bf7025f7f9970e23addc01d7cbf018
SHA512 10cfa6cea716b941aa437b87226aa0df5aedae6995d889acb341b8a84f0cb78d6dd17f1eb25f5673a9d598215782baf41cb31c0bb5b6961acf4b67c0a643aa54
SSDEEP 384:sxZWYH/fcstzhk66s8qMpRiYnazAW8pZS15posJWeT+dPoCKs4mqHbjLM4nyix:suYH/fZW4Mnc7WeT+dPoCK9nHbMyyk
TLSH
T115D2F605A810C87B9EC39D29A93D7E33EAAC005256C5DEDE56ECCA1C01DD5FDAB0B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b66405f6d139aa823c97c2ac05484f1d2d5f1c594518c40359851788fdb63f69
MD5 3559c66ee32646664e83e3bbd1cffae1
SHA1 7c161a4b3255f66c238c475f3663b83cd549f40f
SHA512 a30218f172b7397fb5fe694ff294617e793d77e21a83905bdab526323a22992895b6b324c47152cb078b4f7fbe110c553b90837775421460f42863343181802f
SSDEEP 192:sxZIRGkH/fcstzhvorIdpCRQq0bKHW6+WNJRA5XYCo+rovIg51CJ:sxZI3H/fcstzhvo0UHbgXLu2
TLSH
T13732C9526E2869374CC7D619FB15BF13D6F90432A1951E4CEBFC961C04E7ADD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b2b6b8a56649d0a3ea5622e97e01e152ca4be58d255bfb14cb63142e01ad29ed
MD5 90e518098f5da72d8fa489634f54cb62
SHA1 0db6048e0ccc7ba66316e29972e2ad2eb633c4b5
SHA512 8c4c78f3044e3cb7d632e729b2785afe21a6fe485a4560155ebe2440e176e2a61b23955f944be3ea731a34bae55f5516110887a11ad7e1db554b0dcc306c4ccc
SSDEEP 192:sxZJRGkH/fcstzhQoD2ba4Q4ddpCRQqO+0bKHW6+WNFaRWiRA5bJv/YCZgrovIgx:sxZJ3H/fcstzhQoD14QKcHbjpd/Aux
TLSH
T18B52F85269246E7B4CC3D619FA15BB13E6F91422D4D12E4CE7FC9A1C04E6BDD220BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 99835ad4beba10a573eb502ea1ac2b5a3654b8991c6f768f2b589e60f7599e37
MD5 6e89e206679ec5b95a68322ea27e0bd7
SHA1 87714c38f68208397f1cce4c82c211726e877f47
SHA512 8bf65f77d8b5e13257117abc3c928c6070a23c9be0c2b4aa93655ea5cbafd9c78d073c84ec9155d90b9f2d09a910969277e6c85f5b68247b319c51d8ade977c9
SSDEEP 192:sxZJRNkH/fcstzhQoCKNba4cddpCRQqO+0bKHW6+WNFaRWiRA5bJv/YCZgrovIgx:sxZJYH/fcstzhQoCKs4moHbjpd/Aux
TLSH
T17052F71269246D7B8CC3D619FA16BB13E6F90422D5D16E4DE7FC9A1C04E6BDD220BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a957cdc0059f4f43f3b4edc3506540e909dff59c9ce949f2f0b64af61fa31849
MD5 ca0cb0ed15fca456f45442e8b4577d02
SHA1 f7be3c2d31ca58a82f51220ffd6002369e25a8fa
SHA512 8af25b027c40900d71e87cb6ac9106e6ca827e9c7a8f8d7eabf4c8b6dc1cf89f1e8155c02f77173f05c77f34f558e20ef60a74e3d4169d728d9ca29a4719e1fe
SSDEEP 192:sxZknRNkH/fcstzhQoCKNba4cddpERQqO+0bKHW6+WNFaRWiRWzaVdzoZYCkEzrw:sxZWYH/fcstzhQoCKs4mqHbj+KZ/ux
TLSH
T1A762F71269241E7B8CC3D62DFA16BB53E6F9142295D12E4CE7FC9A1C04E6BDD220BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3c3c1e3e3ea092f3c25657fd0f91a0a6ca76531b384a69f884200f4c95bcc2c7
MD5 101db3b9326283cd690cf3f47c3cdc2b
SHA1 cdfc10b3994d1a819f21bec4ff04cdc67a697fc6
SHA512 e32b26545b1c3c123a56961f1d719eee08b822ae437746d5e19d827445ae93140d0805f438c716332cae6b89e2ba863fad5c5d80f729ff928628ca720d2595c2
SSDEEP 768:PdqbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrKroS:PdqbUj+WvSCU6u1jaaZLbWrhS
TLSH
T180C2E83B340CCA7E4F801E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\527ac3ba-ca81-449d-9d3d-fecafed8a8a6\index-dir\the-real-index
Size 72B
SHA256 24562377a32dd7caccadc0343d51dc021c71133ee060209482b04ee6edf39c4b
MD5 488515ad63cd30cd9d3577d158edb224
SHA1 b7c3f1f0faa30bf48f2f534139f321c30f2871e6
SHA512 22bad35299ed6b528f4ef2f63002ffba9a2e279d03e247c08354a0cc8f1839acaa22afdb5c41e7ed40134b46807084bce9e985c9e0e50f2097b1001a31a8eebf
TLSH
T15AA0021101724D53CE101F7460C3034032159B5551134B1797E1B2ED8AD85E0C115041
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598785.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\527ac3ba-ca81-449d-9d3d-fecafed8a8a6\index-dir\the-real-index~RFe598785.TMP
Size 48B
SHA256 71c27f7a3b2732c5138953672995da006b45fe54e1e604f8b8c507ad62f45c5a
MD5 7001e8a6fb0748b852d59e69df5ea8a8
SHA1 4519927783ab4f0977c068289db4de47fa5274f6
SHA512 4624264ad6f64e7618b424c66515aaa3cc51c57850e5645aa5d817f1e386739892527bf089d44ba9f74f643fbf0d14b2ad6b88750186cab10802a868e1b5c43e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\73396bf6-9aa0-4c97-bc61-e078e8ca1a13\index-dir\the-real-index
Size 96B
SHA256 1b70e392a8c78dd8261b98dcba7ec2b6faa93cc103bd018b5cd8399fe1b5d4b6
MD5 c0ef66d05ab99755b0430218dcb99c23
SHA1 b551a4145618e7367faba7780ba7e3d79a24bab8
SHA512 cff547296c21c3fb4df9c040aca5837ea8b4460445c0331c88d983eadc71e25270d25d78bd54b70801f7cd0081e275e213ecc50fe94c4c1b0777677eb28307fb
TLSH
T150B0220EB2C202CAE0A28FF032C30A0C33A2CC08030B33C330E2E2FEEE003000202208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598785.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\73396bf6-9aa0-4c97-bc61-e078e8ca1a13\index-dir\the-real-index~RFe598785.TMP
Size 48B
SHA256 ca04ea8c10cc4d15e3c51f173e89caff97866074256ad894abc6f11199acc805
MD5 64b68da16cc06285dd0fb95916c2ec43
SHA1 917e68a33c5d4c6da0bac37db0cdc67fc11a679c
SHA512 d2b1d7ae5328157c29b82c4e73c4a0cf3734575600b77911c896908badc398660761b3655d7bc7b5d91d904d9fe982858fe2ceebec31116f88213646c3e15dab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8210ceeb-345c-4f71-8a03-ccbc41551587\index-dir\the-real-index
Size 72B
SHA256 317392e01e65d19025bb982c44d039654321c1a0648f29106dd9766b323a7ec4
MD5 db3bae3c26518ca5ce2d70481e3e8cae
SHA1 2aaedd0f3e1456512a724026f00415fa82629415
SHA512 7319ca62858d36acd1390fbd29051df876377c57ad4ef8211b7778c484af20ac7782971af23b02734f596fc346f0bd98a4efca99882a4cae92393644e9f878b9
TLSH
T149A002320A570191D11107F0559162703325DD510101671785A3D5D5DC7715F4965260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 39e089feec89f3ade0ebe910396a9ae2cd310eb10117f2ac3a9d93d2e9621888
MD5 c7eb620520ea1abb5d637e40a64574a9
SHA1 23401d461cbfa6eaa2d964d1f6534d5a86b8c0d5
SHA512 8990857b71eefb33969af7d97909c3f44c76807a64f5da8e9e2c8302c3e6296dc6ee6cd03e52148600ebdd006b13db61eef5c17569dd71730b81a2bd6ab17255
TLSH
T195A00411CFD5004FC17357F155D357435314CCD03100130750D1C074CC504C1CD4100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 408d3d18068c871fc9bf8c7d824d1774766045500b4e9ff32bdff6f4d0adcd09
MD5 bb6232d3a1259addfe01778dd246dede
SHA1 75ad02b1eec4275fc4d2d49562728af2fe93c273
SHA512 fef021aea55dfe648442fe7ca490574516bc2dc541387603997f99a413e200cb1cd6832227aed431fbdcf9d175ed457531b14bae943d984b95f4a5cc6a1a913a
TLSH
T15CA0022C02D240B1C10712F325A651433710C9710302235795D95244DC505954D4120E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\temp-index
Size 3KB
SHA256 e460e6daf65879ede87bb4891e675aea0a0ff194a14a1ec7eb119fcd165de576
MD5 16e0ee638617144e998027e282d1cdaa
SHA1 bdb53495a1fefc854ce59f73b3ebb2576b203bca
SHA512 7e19cdcbd35bf6be5b28a23570a0eccfd005478f3304ed81af3e3f79de516f0c5b6d0476b61e667a9b2efe80d139e94745b366fcacb4dc34506c4d24466f8e60
TLSH
T10851DA8FCE4A1D5EC9EC06B329FA0196337518EF4704898B3A9CA13278D33391D1D516
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 6a29f2c2f05cb6a2a5074a2afd39b9aeed0c893c9dc7b25880cfaa11d7e6edea
MD5 d39905c9df96914a9d2e0849947e2f37
SHA1 4fcff41c126058dc794892eb82be0e325188b40a
SHA512 83249a0fc8adb49a97591d05334f9f3c019eaacbe907964505fb9bdeb15e6531e03e74bc8b8d90c1fdaaae89b1a2929f876bcbd1391c13e87ca94efc109bd52c
TLSH
T149F024B62EF72890B97B93E5103008A0412A7D48C849AD4E0556B58750B37512459C62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 da18c909bf59b50f3efe19042ffcb5c063e69f1c6d4519ee2b8366d416f8fe63
MD5 a73667ab50ba344c1a8c07d321da392b
SHA1 e994f982c42a11285783cadbc3584353e4c457b7
SHA512 9e90fd8aa081f5149ec12ca7910b269ea13a91c7f5b23cc21e8d8e311c15251bc8ffe9dad1c938ef2dd236bd640de6eefb9c2fd5cd33660d1067715ef4e2cbe8
TLSH
T155F04CBB6FF72854BDBBE3E4143008B4022A7D88C959ED4F0566A19790F33552459C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 77b84bf7f2408d7edee0d106eeabea865343f986d39d3b18a9980f8fdbb7adf3
MD5 04ef52b6831b86e96284f8109f979428
SHA1 66bef046fd53cc3a01863e4776ca5726c5a432dc
SHA512 7efd3c333cc60743ed12ad51509732b08d4142184461ce1c0f97bd40c00c95e5774252af992e56b34f48736e7f33462b043c5fc4cb1cb6045d546273a25b293d
TLSH
T1C4F022BB6FF72854BDBBE3E9143008A4022A7D48C949ED4F0566B19690F33252469CB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 aebcd142d2c820bd66e6245ddf524088171853f2b74de86269f8ade2b2806981
MD5 e244b0e1b72016ee7fea53c2a2a35ea3
SHA1 2f89401a85ac99f4227c59ee43b2c89b348189f3
SHA512 f7ecfa0e15067bd6bacd1bc4cec9f4271e8e4ad291dcd44044b064c84d6e142fc15d2b8bcb71f97cce96a02099ae48e9a81dfbd59e111efe219cec5b664abc2c
TLSH
T14BA002208A4E9445E80506B528A555C873B28C9A154563014DDEA4B8CCA51C095C5205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59456c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59456c.TMP
Size 48B
SHA256 4c549d3a0731bd704cb60fbf7fee3271058600b88a680105af61f9cf4605ce68
MD5 80c0f81f0371a2b18d19d5bb4e1303ca
SHA1 75977bf4ab6459e6c07d12607f57dd66037c55da
SHA512 3f73113e7b4230cfb63eee9555a91d4bae49e1b244a20e3ebe6a4cfc57a5991e9b6803734cf575c15d99f612c6baf00c221a8aa71dbdcd1b6eefbb36a0257e75
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5ed96cd2f819a214ffbe6a2d0fb6863244e422d13361bb86b1d78374709d2e33
MD5 6c2915ca7ab9dc731963aadcb5db262d
SHA1 a9719e14a217987a06ad6c77083e211346aebe29
SHA512 2999ec62725364dc917084cf38ae416377d568a98be01fb3d5a7ce8cf85e771915112e573f8f388ae0590114be17dee2aaeb14607cc75eb44f9a9771f6eb093d
SSDEEP 24:KdbfChYa9dxRB41x+cIjtBKi+haDB1E7RSmjMm8xCyXYCfFufa0dIUw4As+jIjqf:KMEIDKVKc/ytvI9KgcwIdIRKO8MTyb
TLSH
T1B791854731FB0251287E694CA7E285260F4239A33064E96F3FB904AE2F66E111EFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59710f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59710f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0beecb812ddc55c706e4efa006e45f063c1ac02acf8d230be01794ee580b18ef
MD5 e17a3c7895f937563ca0828cda03a7cd
SHA1 f78629dfad38456ebafc15077c170d79fc13630b
SHA512 f987a477591b46da96d0c81aa9a0e4cb3c047b7998c6617dc54517124ee08592a69a65ea1680f80a20ad9195f0b7f0b5a705533b85aa8207700630db4786c729
SSDEEP 384:VZcIhsNQmHVQ1DEa+SOWOtJr0H+HBbsq4MoT:thb4aHOWOth0HgMM4
TLSH
T195828E72697C8CB76DE19145F98B35138EF8806797892B94D1DCBB0C00DBA9D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 322d17e330b9635139da6c6ceb077fbec4303882385f57988660ccb138df93d6
MD5 9176105b1fd271d7e1b1a1c5519d289d
SHA1 618645d0edd67ac1dd6638b05cfbe2a4ed4eaeeb
SHA512 3bc1afa232b5efaf9b75771a9d80614461f5e0913701e5fca52875b68c8bdd9c0e999bb0360587e0fb8b6c0fae39fc18b50fea75c934cee7e76417998939d363
SSDEEP 384:8iFiZcIlsNQ8TUNTUlIl3TZVpEk2Ea+SOWOtJrRH+HBbsq4MoT:nFQlBwg4klaHOWOthRHgMM4
TLSH
T11DC218F258EB8976E9AD8743E77E2D038EBCC057B5856650B3C85A0CCC965BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01e2d88c0bee58b9975a8b4708516ea88c1ac5efdd0cf8e042cc0219c13ba7ac
MD5 0212c33271cd7e2b0a8527f793abdce0
SHA1 53510041eaf64dbbdc77e3ac8981bd93fa08ec31
SHA512 87e25b5b341956a17e5390efbcf449188e6d4a2962d953262916cfa1fc517a6cc1545a336f359570b6c08cd9fec0e83d0fffd1ed7410037499f5adf12ba15ec7
SSDEEP 96:EqONkwQsjpf1bxX5ih/cIPURHl8h4otop5PnD9BfPgvE5BzatIRdy+RqOmcPqsQq:vONk6Db6QmiUyLjHBa+jWOm16RgeocU6
TLSH
T12602F83579786CB79EA26E49F88B37279FE4102BE5962B94D6D81F0C00D764C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 01ba740d09fd69318b0e3d7e957841f67fc12e12c0a40f2f9bb58c80d8626aef
MD5 d3dc5cb35eb50dbb6b345315028d168d
SHA1 94e0880031f32bd3de10c9b3063b5a9c09f7e2fa
SHA512 50df40c867f22566f8674095c9e47b10d2a25874c715fe9bfcd46b933760e3eec8f1dbb46ca305a466e6f9958bf18016a03e7080b9178bdfd286f5974ecca8c1
SSDEEP 384:AZcIhsNQ3TZVp+k2Ea+SOWOtJr0H+HBbsq4MoT:+hoklaHOWOth0HgMM4
TLSH
T10F828D72697C8CB36DE69146F98B35138EF88067A7C97B54D1DCAB0C00DBA9D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b85436f7dc42e2d8a76785d2ba7a546ed664b74ebc034b909a9108daa5b3bcd3
MD5 7ece04046bd973b875818de36225e707
SHA1 3092fa8e6d35e1260c00e9fc8fd298be751c25e5
SHA512 903cdf216e89aac1c0907e5a1fcc477252cbced3d8fac645c9e77423fe8421a0c8286c33fd831e4441bc5bc570edbc9f8a9f9925e96394d2b6670f060b1fafc2
SSDEEP 192:WONZ6Db2QmiUyejRBa+jWOm1OySJr+Nz2qTU6:WONZ6qNRBa+SOWOtJriHU6
TLSH
T156120A3679689C775EA26594F48B36179EE84027DA8A7B90D6DC2F0C00DFA5C234FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 05fa80cdd56386fc6eef0b1e5b5f0014d87239236fdf7effb2ea6be91971d8e6
MD5 ea8c5bf1aaff5bf76197fc1f0e365872
SHA1 e5f5dadf0340468ea605db1f98114a42409b4f44
SHA512 c854715735baa051d7c20ce6e85fa53fe01c04f4af0b183aa0095cb2ee5a5f1dae1ceac07bdd65fe9a60b293080600199b301cabd73a95fb2017c2ec6733364d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f2042ecebee4a61d7ac76194d6fc5adee16067479ea3b1557507e8ca05490b4c
MD5 845846677f83c92a9e0296f4b208ff2e
SHA1 3564e33e904045479dec129f89d7deb4b05d3870
SHA512 ce5fd588a33e340e6831fff6471d2a289cb9dd40d11ab75809ac669808d7abe5163bfbb260519722b488c8126a036195dcad76431d012a44792d1501ae602e4d
TLSH
T132E0011293402179C02C037000431B211FD2842401E116469B3021AC1C363007E31E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8f229cc3e9c87d21756b357694217f265703188e8973a180aa7433a85d2e01cd
MD5 1d30a7770712129e9b2917859010b87a
SHA1 ee8ad3a009a4ba33b61a55aacbf0e0830a4a4695
SHA512 cafc1818665d233afe6855f38f05d16df825e5653a74df5f53c7b2d61dc243c97d533f8e7548a676360384edf7ca253f765e96e87d15a47779cbb31a56d1391f
TLSH
T1D1E00153934021BEC03C037000431F211FD2C43402E117479F3061AC2C363007E31E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7994b171c293754820e245e2ad288fbd32567429b7e1395ab30a8ccbfc13aa69
MD5 801ac073afa802f2c943edf6271940cd
SHA1 9006974756b4186be3a860010a4f7e9502520b40
SHA512 4b653ed3c7ec6f5a91a70404a2a3cd8f9afde6eca39a09890f0430fc96628e8d26a5d9b2ba9f11c09adf0e329b58e8a6f7ac693f441a2f9347569f002ceaea2d
TLSH
T12EE00952A34021BAC03C437000871F212FE2C42402E217479B7161AC1C363407E31E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58fc6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fc6c.TMP
Size 392B
SHA256 d6be71b526bc2cf51cec4144af96a86f4489654830ecb0360ae6acc414aa1dcc
MD5 eb393cdcec53825e247847b77f5e2ef4
SHA1 0b0d81d4d67c879c7315cb0aa285c4098a3062c9
SHA512 1ff7abcf57f9d97a1bdf92207c01657e883e9550cd59da9402bc2fe23c6adab2ae0ddc0bcf2c542c505021b7f4ab7e7a937258edf4a52f056f510aba858ac2e1
MD5 SHA1 SHA512

Submit Download

3e105549-5b59-4c3a-ad0c-aa0dd8e57d87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e105549-5b59-4c3a-ad0c-aa0dd8e57d87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9fc4b3a4a7a032fdf3c8558943046a92a1ab45cff2ed0f43524ff0e650bf0ac2
MD5 8e40ce9e76457af8e864c1ea41af7c0a
SHA1 4285d06e488d9ace8e6816b1232c61281967cd6f
SHA512 fed47e39fc37c6111fbc0ad27a8d51969383348627891376d44af7cf5bb39e04478147bfe9189654650b05e34416a2c58716dbbb3e08b05b03f79ab778dccc95
TLSH
T139411459B6FA1148B3B36E4A9BF6A86E447F7D372F06945E10010E8F0623B41C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download