hxxps://assistuclo[.]site

Resubmissions

16/09/2026, 07:33

260916-jdpc2saa673

16/09/2026, 07:17

260916-h4bzza1v7m3

16/09/2026, 07:06

260916-hxglwavsbv3

Analysis

user interaction
yes
max time kernel
599s
max time network
600s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://assistuclo.site
Sample260916-jdpc2saa67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340176110556640"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{2A9AC1B3-5921-41CA-BFDA-C56C3007569B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4976	848	msedge.exe	87
PID 848 wrote to memory of 3964	848	msedge.exe	89
PID 848 wrote to memory of 1596	848	msedge.exe	90
PID 848 wrote to memory of 3964	848	msedge.exe	89
PID 848 wrote to memory of 3964	848	msedge.exe	89
PID 848 wrote to memory of 2528	848	msedge.exe	91
PID 848 wrote to memory of 2528	848	msedge.exe	91
PID 848 wrote to memory of 4212	848	msedge.exe	92
PID 848 wrote to memory of 4364	848	msedge.exe	93
PID 848 wrote to memory of 4364	848	msedge.exe	93
PID 848 wrote to memory of 4364	848	msedge.exe	93
PID 848 wrote to memory of 4212	848	msedge.exe	92
PID 848 wrote to memory of 4212	848	msedge.exe	92
PID 848 wrote to memory of 3172	848	msedge.exe	94
PID 848 wrote to memory of 2664	848	msedge.exe	95
PID 848 wrote to memory of 3172	848	msedge.exe	94
PID 848 wrote to memory of 3172	848	msedge.exe	94
PID 848 wrote to memory of 2664	848	msedge.exe	95
PID 848 wrote to memory of 2664	848	msedge.exe	95
PID 848 wrote to memory of 4396	848	msedge.exe	101
PID 848 wrote to memory of 4396	848	msedge.exe	101
PID 848 wrote to memory of 456	848	msedge.exe	102
PID 848 wrote to memory of 456	848	msedge.exe	102
PID 848 wrote to memory of 2064	848	msedge.exe	104
PID 848 wrote to memory of 4980	848	msedge.exe	107
PID 848 wrote to memory of 4980	848	msedge.exe	107
PID 848 wrote to memory of 3064	848	msedge.exe	108
PID 848 wrote to memory of 3064	848	msedge.exe	108
PID 848 wrote to memory of 3064	848	msedge.exe	108
PID 848 wrote to memory of 3380	848	msedge.exe	109
PID 848 wrote to memory of 3380	848	msedge.exe	109
PID 848 wrote to memory of 1004	848	msedge.exe	112
PID 848 wrote to memory of 2272	848	msedge.exe	113
PID 848 wrote to memory of 3516	848	msedge.exe	114
PID 848 wrote to memory of 4288	848	msedge.exe	115
PID 848 wrote to memory of 4288	848	msedge.exe	115
PID 848 wrote to memory of 4288	848	msedge.exe	115
PID 848 wrote to memory of 2708	848	msedge.exe	116
PID 848 wrote to memory of 2708	848	msedge.exe	116
PID 848 wrote to memory of 2708	848	msedge.exe	116
PID 848 wrote to memory of 4184	848	msedge.exe	117
PID 848 wrote to memory of 4184	848	msedge.exe	117
PID 848 wrote to memory of 4184	848	msedge.exe	117
PID 848 wrote to memory of 732	848	msedge.exe	118
PID 848 wrote to memory of 732	848	msedge.exe	118
PID 848 wrote to memory of 732	848	msedge.exe	118
PID 848 wrote to memory of 4224	848	msedge.exe	119
PID 848 wrote to memory of 4224	848	msedge.exe	119
PID 848 wrote to memory of 1240	848	msedge.exe	120
PID 848 wrote to memory of 1240	848	msedge.exe	120
PID 848 wrote to memory of 1240	848	msedge.exe	120
PID 848 wrote to memory of 8	848	msedge.exe	121
PID 848 wrote to memory of 8	848	msedge.exe	121
PID 848 wrote to memory of 8	848	msedge.exe	121
PID 848 wrote to memory of 4656	848	msedge.exe	122
PID 848 wrote to memory of 4656	848	msedge.exe	122
PID 848 wrote to memory of 4656	848	msedge.exe	122
PID 848 wrote to memory of 2272	848	msedge.exe	123
PID 848 wrote to memory of 2272	848	msedge.exe	123
PID 848 wrote to memory of 2272	848	msedge.exe	123
PID 848 wrote to memory of 4356	848	msedge.exe	124
PID 848 wrote to memory of 4356	848	msedge.exe	124
PID 848 wrote to memory of 4356	848	msedge.exe	124
PID 848 wrote to memory of 968	848	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://assistuclo.site
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff90f6fc188,0x7ff90f6fc194,0x7ff90f6fc1a0
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13213193660189761016,3387760286803205056,262144 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,17861319288598594419,9477272076099934435,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,10600011003451054446,462963677810852626,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7467259206661010259,7185861520016178704,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12599291499504927621,7181238460212373702,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,4187497606672361355,14223704316393256710,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,10016422424555234136,9918972050243635331,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:2
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,4259527208018517114,1448730706006639701,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10901031016198226430,14566474372221331750,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,16532469466505366816,12863350606048029625,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,16532469466505366816,12863350606048029625,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,13836306234735232111,12432456655261338708,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4452,i,5767985352863180907,5750089304211970932,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,2740464914895045173,5467280267350179782,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,7559651393121554977,13674837953659547160,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,17172714642311513973,3101551879918043454,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,9933990638351078948,17157137256793706029,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6760,i,5906254134586922478,10286711287180282679,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6964,i,10578110308240071158,5587695609309228099,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7112,i,8875343712246298426,11168898116970218070,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7232,i,12485614137167317932,3007808055662237671,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,15058938708655981853,7553536249453427197,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6248,i,6739410041018257097,1641571501996993894,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5288,i,7652196256367820441,4476871557797764844,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7136,i,13150865769267052911,11263189462559531924,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6356,i,6680585456743869989,9640529046672671415,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7948,i,7782739008712946947,4327418543318287569,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7916,i,2751603609786609850,15575132181802616270,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8088,i,17258223967149909670,17691526453553215915,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8148,i,10531139084351709012,9169921590392725541,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8256,i,10927890926718751379,12468155461212217802,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7840,i,16767770671427028725,6480675290530899372,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8560,i,7183799167460594273,15585225029153993358,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8704,i,13667490781145634557,10664502305333179388,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8724,i,5332084000657356188,14664813301636477732,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8992,i,596430730665305763,608935533539552155,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9004,i,12755377336690377601,2394965685127052677,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9284,i,5642658259848952315,2128844244091435122,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:1
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9424,i,4762786643007810273,5184113800548252933,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=9444 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9488,i,111971824161768069,12785888115290687839,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9596,i,14171628600569238259,5556471269647774799,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10200,i,17244065756588862682,9418650616896542248,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10208 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10160,i,17159689644880631790,6685659250116116039,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10188 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10288,i,6660419414926410088,361443935199197880,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10124,i,17291389829629457964,133752493717209281,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10440 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10444,i,15363920643729064377,1970312536501406411,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10468 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7352,i,16269098790035190924,11348660852045551092,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8636,i,1223556803427728011,11919388959218080060,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5144,i,17078755526962068470,495672412369878022,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10640,i,8211168224916247116,7409353531343147811,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10548 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10668,i,430049556506763956,17033392148515132787,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10688 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8648,i,16859436420866248272,13230036878963858615,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10860,i,9546175816115264529,1582156290994201901,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10828 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=11144,i,2982459513909534925,13799727460454295196,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=11272,i,3063219699945969591,6081201012904787283,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11292,i,14595907969078542678,11431218472739002763,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11308 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10960,i,10251833897652340943,826950481898284134,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10664 /prefetch:1
  2⤵
  PID:6396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=11668,i,18055318134522382737,2416083005810751835,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11664 /prefetch:1
  2⤵
  PID:6452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=11284,i,5571096974400486085,13681884005130885513,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11932 /prefetch:1
  2⤵
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=12048,i,7481039099966578079,6882695520466429147,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12052 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=12188,i,13333561080099911592,14693698445384881034,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12096 /prefetch:1
  2⤵
  PID:6640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=12316,i,11939553658556984189,3286430105234336177,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12332 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=12448,i,7517180389756996254,6697381530899095382,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12464 /prefetch:1
  2⤵
  PID:6656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7320,i,12977867391411925557,13280526804899406957,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11284 /prefetch:1
  2⤵
  PID:6932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10636,i,17882187315149139735,2760540416054058926,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12056 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10876,i,3496817167435095800,15796196182710450358,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10932 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7688,i,7978327898078073031,18381170413841267734,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11988 /prefetch:1
  2⤵
  PID:6892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12384,i,862813174630194908,1902594504743244412,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10932 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4864,i,14685799243395619392,14913873452039671300,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12076 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=12680,i,6684659506552360511,16745152659331467756,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12380 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10932,i,14817249956606291356,738680123301762080,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11060 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10816,i,305223279984854269,17856672190194234934,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11720 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=11028,i,17556065349994040138,5790362072231423516,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11724 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12220,i,16949049442196494075,3426403486985451151,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12212 /prefetch:8
  2⤵
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=12444,i,10693655264457365561,16994792289097872410,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=10900 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11676,i,6572111225694715748,9920500393360799059,2097152 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:6836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=11284,i,4482034572047058104,11870512510491411738,262144 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11784,i,4764862475752662847,6783702303476599142,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:6300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,12493119065296470558,1283978736123359626,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=11152 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,12127024702724538230,675476629702033425,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12280,i,584790822178155630,875196623819070249,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12220 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,10957370513295995747,16057526452691130311,524288 --field-trial-handle=2732,i,17991701402966404515,4286186593444325982,262144 --variations-seed-version --mojo-platform-channel-handle=12376 /prefetch:8
  2⤵
  PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cf2738ccf19d6f0e6cd7140eed04484dcf5993b5518e61900e0718f53da3e561
MD5 7eac79512f341c0d23eb66610ab488ec
SHA1 fb480051bdee2bfdf18038a9d25184e8ad073e80
SHA512 22d026ce1dbfeb6f1497622e2cd4919a3fcdc1c4aa694a019ec1a75fc4c2ecf84c462773737c5449cd3034e6e7c64d70d380336404b13e67bda7e7019eb85a4e
TLSH
T1A2E0208414C5CE5EE64077C791AC678C82C07F4BB2CCFA151788D48974020946282551
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0a4ac3d8ee89ccb84fa63eb14a995b6347a0bb220ab4be2cb74b0faff0427f83
MD5 cad34ab85afcab535ba62e182b4d1e19
SHA1 a0c5d93f413b105faf4f6042df1a818328358bed
SHA512 6cfa6c41721e4f07283965d698ac39a3fc6ece3c1d930963efd1f46bafb79f15b75fccdade1b89f279ffc1e9a8b1faa11ac223fc69a0642083cb1cafc7196257
TLSH
T164E0209405C8CE7D6651754BC1585B8C8180F74AB3CCBA451F408448B4814E0F6DD5D4
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 97KB
SHA256 6e9619cbffb6bed8cd7172c3bfb896f170dd8aac932a3f1ff11bc035b9d53e6e
MD5 7d4f7c31059a29d5ca4bcc8c3090edce
SHA1 1ad0961998e6fd8a57ef2ef6ce4bdee9fbd555f5
SHA512 c283558d93643e09adf26081eee657f56f1699ae7f25a26c25ac19bd6372744b983751ef58cb88f632c1b67394643fa2ef8e6f8d61bfa39887ccbd8ae2f951a2
SSDEEP 1536:c1Ah0NShqi8NjZ+0sw9S54zgbiEvgZXRkSr/TSg:cvN19v+ZwY5liEyS6TSg
TLSH
T1C7A312EE8B71C246E90D57294D20724EBE7A834417C8AD26FBE1F713C6C4091CABD746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 3572c65e08687a86c361a974733e31619befcd817603d6ed3436b93aa613af05
MD5 f8e89eca3f326325c5ea927285251779
SHA1 da118718617251ed6dce1aff94bb4b3b18858cc2
SHA512 e8d90e24c6ddaa01b5f550c9e90a12a7d9ac2c70b36ac90a5384a2bc32eb12e447c43f2055ccf451e31068fe61435b74ea3400b5b6a8b70418a4d78eeb97a050
SSDEEP 96:0GUZUPlEE18F2PHYm3lsjqXS7nJyf//ZtTTLPW231J9045MZzQNOB1qK30ln:cU9Ev2gAsj0gJyj3a231JmoMhqyV0ln
TLSH
T187F1B68B9CD68DE2FB5874B888EA0C513D313D7F2DA35E03291BCC756E5B393509A864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 8b59201dfdbe4406647988b00d6c4bb9b0396bf7d4eac8415ff018af35f64f9b
MD5 fb25c949f8a9cb7315d35cac08af5ae5
SHA1 4e5b86374e5300c9a67864b3e61bcd1b0ecb94e7
SHA512 1fef9f75d84f1650af4315f04060fc5328e9f68bd82065ea84429b03274901ac69a346547293f0c3baa1df504d00bfa6672fa1cf045a72decf84ade788a25e83
SSDEEP 96:rGLCUPldE18F2isYm3l3IqX17pJyf//ZtTTLGW23wJF0452zW2OBGqK30lY:XU9dv2sA3I0d3yj3j23wJeoULRV0lY
TLSH
T14AE1D88B9CD69DE2FB5874B888EA0C513E327C7F2DA35E03291BCD746D5B3935089864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a05ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a05ce.TMP
Size 3KB
SHA256 dded9c159bd4e5eca031916bda151a3f27a19dac70cacd57b55c690d019e4088
MD5 4639996f11b8b4664f44cf12fe0c44d6
SHA1 7446648e5773a22178e5521d45cf46bfc2d137f4
SHA512 c1109eb04ba49fe5568cea5e333f105ffd0460f1772ddf80b10d5202f0586c20f912c0b02128d4dbc8501983e5dd649864f487b1d5dc247c00876a242d5d68f3
TLSH
T1F261824B5C42C266F7A88470CDFF10AB36774D83B4C3AD123DACE6BD840E726615604E
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f02a0c9-3a0f-49c8-b152-d00c6a5a4a7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8f02a0c9-3a0f-49c8-b152-d00c6a5a4a7c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 dbb181ae983c07bfe7d212193176e2a8c4094b8cea69a112b895b39685e869a1
MD5 34139001e628a14f2d474ae97ebd2340
SHA1 5b55d6af0c6775344864d7ea980dc80871bf77fd
SHA512 12dea55037df0a0aec4cedd7f8d63249d96e5dba6038a280102d21ab47fcbd9bb2e2a04e4c489dfba300b4f5cd4879235d9632f8b9e8aac57bee35d5a6209988
SSDEEP 384:DnlSBk3K/SegW5uevDQaYJqcJ80BeEK0J77CW157c5OGJttBPigcIkcJwIcPqava:LbFNMWLmJTOLbL8P3jvxw7i
TLSH
T182039DF783F089BDC91266F09E241E1BCF6D045A031C7C7B8AE46E5753E6872E29164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 38KB
SHA256 3738a92e5b098ee24cec0cf2ff6ecd1907e20ce5853aa4c9ddf1d476a46cc743
MD5 4b1f5f41026f8b0aea11fdc8114c130f
SHA1 f9511d6ee4d1601e3a2ee31dd719762421edfa4c
SHA512 10546d7e897943f298b2cd51b64e6c07d325163041db91918a3d67f9fef97807082779b1bd9af7da697533f952b0e0068abf9835ef9b4ba679f4659547fc0443
SSDEEP 384:DWeVxiSFKPehitLe0pqVNJyuJa1BepjFO8E/bKYgdQMwRZb157cH/GTttjPigcIe:H1yMLWL6JT8jFh4dnx+lZQd0Zq
TLSH
T16103ADF793B089BED91266F0DE145E1BDF6D005A031C787B8AE07D5343A6872E29274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6a911a6d1f081a9544d5b51e36add326bac743f663a41e2d6a721794f349c129
MD5 17eabdcbefaffadff6562070b99c1d09
SHA1 59aa628b95630d76ef388e0d9fcd50b4a4db0651
SHA512 f5c16cfb10a3c4d7c2854f1425f6f05488351c51e945f9894cc758314af7cca475ff5d7fda3528a97612a2f8e3a39dcd3c737545471896fb06f9d7f0ed553b8f
SSDEEP 192:sxZxRBnCb/f7sKBOz9IdpQWHW6+WNPXE/YrI2T4IgUpJ:sxZxzCb/f7sKsz+bHbc/JUT
TLSH
T16B22B7566E38A57B8CC7E21DBB19BF13D6F9503295901E54EBFC862C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5c80d944e6685e17c172fdc52648f61f4d0f3eec5500a56b7a3096bed329ed12
MD5 4b5e7f5179046e2095b6408fd1b713d0
SHA1 274a258d691f2c5b33443f539d95a12c72b4accd
SHA512 162ca3b34c82d1083e3207b7f18891f18b639f6fef41d696cc93c9678ac0a45a04f49ee51ebc9230e67d29aa8c002f8a807b95637da75a896c98185d66f9e95e
SSDEEP 384:sxZUymWCb/f7slszX+ef29HbhYl/eGOdE9R:ssymWW/fHXJ4HbSDQE9R
TLSH
T14D62EA567924997B8CC7D918FE35BF13E7F9142389911E4CAAFCC61C04EA6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7b0f7117f7083d809faf590f00bc347d9dcfafe29314cd3a654b32ff3e0a95a9
MD5 709b587da51122f0d00cfb77f538f5aa
SHA1 662177ef2f5e44969790db97f360465286e9faa4
SHA512 c17545d0f2b576cb5734a5b9c5c0345423b6d5a81e18a1ee71cd48ca9d9be99cd2b458b17c74f939323c229c21c45ae96b29b50178c803180795ef3530aacc3c
SSDEEP 384:sxZCBmWCb/f7slszg+ef2tHbpgCl/EGOdE9R:sqBmWW/fHgJUHbfNQE9R
TLSH
T1D6720A967924997B8CC7D514FE35BF13D7F9142389811E4CAAFDCA2C04EA6ED2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4c8a65bc6ec7293590d9bcded446698df546e37566352005e89c8d60c1681b0f
MD5 6ff660ef8b0c2c4f90595714055c8af2
SHA1 3ca1f72128eeedc290fcff7703371612a41f353f
SHA512 97f353c9f417b6e70b8b1f55e3fc4085b6824fc9188e7a9a606ac366a5c1f75a2ac0f80a634cbe8b89081c2c92e6ef78bf8eefa171e4aee1a2368a81f86688fb
SSDEEP 192:sxZURBMPCb/f7slBOzB+1bhe+cMddpmLR4HW6+WNPXEqMS/YrD2T4Ig5IpJ:sxZUIPCb/f7slszB+ef2o4HbcY/UGT
TLSH
T14942E9567D34A93B8CC7E619FE15BF13E6F9103295950E58A6FCCA1C04E7ADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 4069f45588962e46f9c0f1cfdfb39b0c0b62999e65e7e786ecd00955d7828e8d
MD5 6fbdb2364f7531b20a57167053fad53a
SHA1 13f10f97c579611769af10382983586f52bcaabf
SHA512 6acb8f7ab2f76c1fa5b7873249a40ed42fc0421cb658085862558f20e171f4ce892094324a30610624e0b81a93bb580a71cb83408be0b4efa66210a7e9ce07d2
SSDEEP 384:sxZ1BmWCb/f7sr66s8qMpRiYnazAW8pZS15posJWeT+Mszk+ef2aHbfegCl/tGvm:sNBmWW/f24Mnc7WeT+9kJ/HbfKwlE9R
TLSH
T1ACE20A55A820C87B9AC39D28693D7E33DAEC50525AC5CEDE5AECCA1C00DD1FD6B07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4f151bc70e0365762b83f2d7987da65c8f5494c09e6011e232327723a60c857e
MD5 db70a32ddb1ba43179e30ac3ea095409
SHA1 853c5934c57c9fd437ae4a785aa44961fbe61d13
SHA512 f0d46430550fef4b102d438bd3f7a89c858734ad2169fa14d38bfaf0de00b61bf1e35ee1b46693322d5c62843022e3bd6e37c214992f169510dacf1b6f22b35f
SSDEEP 384:sxZoBmWCb/f7slszU+ef2VHbsgCl/EGOdE9R:sgBmWW/fHUJgHboNQE9R
TLSH
T10C62EA567924997B8CC7D918FE35BF13E7F9142389911E4CAAFCC62C04EA6ED2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 81642970f18f182d24664279254aa8add59b3e7b1155071f2497136e87e52aad
MD5 5c18b96807d1dee35ed9478bfd034897
SHA1 4ec5e1ce43b88929933f9b4ebf724e5291ac076e
SHA512 c37a766761255a7306898ef4bf00be8a4b0590c193354c39a5284ef0bb9abb9cc8f600287e812eec5a80734f9ad802b208fbc335f7b636750f3b13dfdcb75992
SSDEEP 384:sxZUBmWCb/f7slszU+ef2bHbhYCl/8GOdE9R:ssBmWW/fHUJ2Hb/FQE9R
TLSH
T1C062FA567924997B8CC7D518FE35BF13E7F9142389911E4CAAFCC62C04EA6ED2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8ac5b20c433282aed4c497a606028203c819a1e9772d70d00635e17a7b4a262b
MD5 93a5b29a70f91028b310d33fe14d7c9d
SHA1 efced0f649ba44c5a82b3f86f4b0a1ac889de2cf
SHA512 9f46ef04391679c85410504057abfa7fe82a839898e54de8c57a450302584098b80542a98169bb7ed5128d093cb4788aab40b6b1688c372b9d41c0527b62d084
SSDEEP 384:sxZ1BmWCb/f7slszk+ef2aHbfegCl/EGvdE9R:sNBmWW/fHkJ/HbfKNlE9R
TLSH
T16D72E9567924997B8CC7D524BE35BF13D7F9142389814D4CAAFCCA2C04EA7ED2207857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 64ef1278c202a7948760fd6c0c197c51105a6bee77831b4eeedc365b2abe6800
MD5 31b49c3eb6c0dabe5df216cc56adab5c
SHA1 3e258e05e92c9e745a1aa0db03740ccc63829503
SHA512 24550d9da76940c99c8d3a18fb9061aa248f476771c3cc3f1560fcb10d625b302d23894507dd16ae38ed666e6056ca307099a7f050017ac5e58825c12df17932
SSDEEP 192:sxZxRBnCb/f7s0BOzcIdpQR4HW6+WNPXE/YrI2T4Ig5epJ:sxZxzCb/f7s0szF+4Hbc/JIT
TLSH
T11922B7567E38A97B8CC7E21DBB55BF13D6F9503291901E54ABFC862C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d23fd3cf32c01731ca7e3f57a0e0b2a72a8bf74eb95d6e57c7eb73581ab777a7
MD5 0cb3d3254d3ccabeb9d22e894f428662
SHA1 0598fad223cb186922a9917d4899984c2dcc3806
SHA512 e4e4daaff110880937a2e73d69635a9e2cea860d846dcaf93afdda2c67cadbfd9addc573152b11ad583b31d5522e5625f60d3b45c14e6cba49946e2c81e87234
SSDEEP 768:y/y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb8roR+m:y/y4J/DWvbtBhu1jajiLm0bnMm
TLSH
T1F0C2FA3F684CCA7E4FC00A9DED5E6F973E9802C796948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0ce41c56-99c5-4766-ad63-21f2cec5a830\index-dir\the-real-index
Size 72B
SHA256 05280f08eae409ce0075e50579abaab35781f11d80d225d9fc7a775d63015308
MD5 92da4c8a6f393c64ccb020d4c598eb02
SHA1 f7d2123feb7758bfd8822d292ed9799a0e6cf1f8
SHA512 624fc968ed6550d7e318a8d63ad3b9895163c8aba6347d9a0a5c3736176f84f4220ff5b636f22eaee359f49d8579ceca99ececfb9791d8d4fcd17cd279c90ac4
TLSH
T133A0027C02D82051C40266B466D715696750DA542642335771D00244CD906474DD146E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0ce41c56-99c5-4766-ad63-21f2cec5a830\index-dir\the-real-index
Size 72B
SHA256 39ab12b90ed7c4fd0f53ba600df530ac9378c1df941ef266eab69f4699bba352
MD5 c22430cdff17e1457eb2817cb84a41e1
SHA1 2504c2353246504cb61dace0636e40929387abff
SHA512 a3f599190c16f014a2bec5870717330e2c4cc10be0226934408ec54a33a701443ab0dce817fcf7109aa4aee750c3f3a289c452c737ea31a60aed74d89ec24c0d
TLSH
T16FA002261790114ED012D3F5195612622307EC632A10130740DA4098CCA54414FA200D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\def216cf-cd80-4ec5-9c74-e86d9de98628\index-dir\the-real-index
Size 768B
SHA256 c1ae21b87fe86da67e7e91377d670f1c52efac024ad78da28a0dc7f798158b8b
MD5 aa70497bdbeebe3ead99821e08f6e422
SHA1 bc3420c6c3d023e6cfa0f08240dcc06e63d67533
SHA512 96c109c3a952a5f398579b21c3c8d89bf3109fb0a62bea2040d498a142e50607d61738eae4ce4ee2c279151a97d84412fd23386ec4b32fb6c364497f063a443e
TLSH
T10401E1D61D034A46FD510270543CB819557501DC0351794FB2FDC1269CA77807E46AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\def216cf-cd80-4ec5-9c74-e86d9de98628\index-dir\the-real-index
Size 3KB
SHA256 b4becb9bed60024a12fa8954f4658cd497cd7ebdfaf0fa927fe19d9d24e684bf
MD5 f6ab62b55d1819884d8865ae95cf5de1
SHA1 920159c69e451d190b0fe01e31c8d3fd7dbb0e39
SHA512 74241bb02a8f2e1037dec35ea9c6840a66218915fc8a995e0d9a61f4b2a43c3d7e0cc0b21aad831edea2ddbed720f01cf313159b53e35898288c4ab64f872059
TLSH
T12951C94D5D075BAAEDA8517114B50884337425DC43A42A1FA5FE8138FCC3758299AF65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59456c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\def216cf-cd80-4ec5-9c74-e86d9de98628\index-dir\the-real-index~RFe59456c.TMP
Size 768B
SHA256 aef47ab9283269d0979d8f590ed202c65e7fb26f613159ef0810c363ac7168fb
MD5 196edf3b4aec1015ceb5120a719b15c0
SHA1 316215f6531642a4fba4954df524321678e09279
SHA512 bd078439a314a5091091c0dfaca1d3bc8a9ba89e1735face2b4b9e44143de5c10f35c0f6ccc2b6526ce445c082b4589343d96ba8210d280dc49656328f7fcb26
TLSH
T18401C0D645134B86FC0443719A3DA416616A918853947B4FA3EAA566CC52B80BD83FB4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d1438045af08d5bb5f7dcfb9f7002722a7f066f47b381f403232066f9c9a93fc
MD5 e58aac28b880a842f429704942ccc2e7
SHA1 a47762abc1cb3109aeec25dc4a56a5340a3f4c05
SHA512 4d68a9e400c564505a224523a63d12dacc534436ad0ed959be8ccda3954efa211670c4e533277a9cd6e607ed296a202a77f5fa46a64e09ec143ec7c51aa7b443
TLSH
T1BFE0C0BB3EFF1420FCBF97EA2C7061A00010B568CC04AE8E142B56D3207231428AAC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1ee32760e96e521ff64a4e8fb0680c81aeffdc9b26abf2af4fd03353346f4a63
MD5 2eea22a845828688f9302643e69170d4
SHA1 3a93bf4b10cf3479377d2540ce953ccad9a17fdc
SHA512 0087553852ebb93b86d169fa77185662f3e466c8e61cd8be2a11f6c7e797d5609947f1d20a5277a22fdf77e5c74d8bdf24fa31257adcba530131805e6715b48f
TLSH
T1D0A002389BCE9081D5000F7558655E61B7B49DAD05461313C9D8E49E8C9514055C1655
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599be8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599be8.TMP
Size 48B
SHA256 fc7c889a55cebb1ba7a0464d2e90be3338e83174545d00d09c35da9dfdd7854a
MD5 82746d8974a6db364cb66f4a355076b5
SHA1 5d5fa27557e3986400f01b651c53334daa57810e
SHA512 fded08e9a4f2108c64fbcc26627033c9c876a2fe579f6e76379e10ab62f504c705bc3e712f7d9b0bf88e2c00eb670d5fe00f10745b5634e5cd183b98b72a00d9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c86e953d2c61427a2a6ec47ca3eb85253ed1f52faadb724a11500ecbae3bd940
MD5 acf372e4bc082ddee4a4af6cc73109f9
SHA1 a6bd427fdae69a4f49af5dc0a91b0d269517899d
SHA512 9d911e1cc395991070d4101b1acac27524222e02be6b17c0a959c319631454e9c1bae6f64597dc3b23358367f69949703ece9409b4e1157cb7ec5246030f2ffb
TLSH
T181B022A8A300C002E30E8BBC0CC80B00B3200C308323822382B2080ACC223C08F03C02
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e54ae6c5ce21671864779cb2f6f673e6a8a962f9a6f330be0ab21e1309e85936
MD5 5b64e4798e15bc6b88cfe619a71844e1
SHA1 6511d126be511c5bb724e568c903b01f3c5c38af
SHA512 991849e2db9309129b258f43d81293e8c793d5507a756f3e0b76989830715cc95d9b1a31ef61b004d7131a0ae38364bfe8a857419cb025e565a1cd461fd1faaa
SSDEEP 48:KIDI1Ks04jyL5f5i5r5/5B5h5B5ab555U5pIS5P5aK95v15l5ax5/5KY5s5t5v5F:KIDCKs0+aS8K/aeyCgKDSqe4
TLSH
T17991229572BA021138BD6848D2B59B1E424132737058EA3B7FFC4856DE6BE085DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59de9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59de9e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 564e337db58ac516b1769751408f9504fab1295868da17e4597288a29d1c8443
MD5 ac357b60df74044e0d7625dbbc920806
SHA1 26d3259e9276d72a45166413fa45b426bcf85923
SHA512 2c5a6cd92746e519ba91bb02ae269697cb65cb42aa16528f8a29753b8c09c33b7236d2de9ef6ac7b09b72deffd358a9ffc2c5444b54fd174d063fd75c29b389a
SSDEEP 384:FZcIisN/yadZsFKBuHX58EcOWJsUaq3sa+VYZGto9:9iqdkKCabOVk3hgUG2
TLSH
T18F827D767978AC375CF2A645F94736139FB48163D2C96F94C2DC6B1D00ED6A8030AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27e2b730c9633e104b5317869a00bcaa6fa19749becc3fdaf1d7c9dd7106ba04
MD5 c1e8d94890a2ec0a508ee13dc5aa4723
SHA1 45be88f2845e945f0c86a34438438112c9a73783
SHA512 b7e19151b6df73a0cf7313a8aae03dff1f23561065e31e54a0371435c64c5e17575e1e183672f346f0c7a6245e3b46feb3dcbd574ac600156570fcd27573b377
SSDEEP 192:1ONF6wlDgQmiUyECW4X58gZcOKBJBDlgBA5U6:1ONF6kgGW4X58EcOWJPtU6
TLSH
T18C02F838F9787C7B9EF2AE09F5873B139FA4116BE5552F84C6E81A2D00D725C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ccec9ada870008da39f4c971bd5bd7cbb6b6d6ee3b02e9e5913c2988f80ea3ad
MD5 41c8a2817ce16d429a10fce508c2d173
SHA1 582f63f214a2296b9709d7fb1bc97f582a7808a5
SHA512 8670230708b98af86143326278bf721893d7391c343ae47f97d5ef2c962f65b995cf9999c6da302753fd483db394698891bd94676bfd2a2dc7d27881251cd3ba
SSDEEP 384:rZcIisN/dTldZaFeBiHX58EcOWJsUaq3sa+VYZGto9:ziAd6e2abOVk3hgUG2
TLSH
T151828D76B978AC375CF2A645F94736139FB48153D2C96F94C2EC6B1D00E96A8030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a77488b6ea44f95accf058b0c4c7c3b78611acf14e1ab4447353f441ae300d4d
MD5 dbd65346a4d4f5977dfd2a6a78621df1
SHA1 e3af7180ae9936e072c76c68c5ba699c9f679e4f
SHA512 5ca148b87f00168d90f67d36371ae1fd64370243ae4a0c8d46d434489626392aa779547573d416c60e66bb98fe626e41f37860ba7e2ddebc697d81d4304b86e8
SSDEEP 384:DiFiZcIIMsNh8TUNTUlIldTldZaF8+LBiHX58EcOWJsUay3sa+VYZGto9:uFQPYwgJd68+L2abOVE3hgUG2
TLSH
T119C23AF658D7983AD8AE5B43F77E2E038EBCC053B1846A50B3885A1DCC951BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8901ad1f9f6c00fc6da482a23ca2ac735fea80cf3fc318c8d1ca9fcd68bde02
MD5 b72be45f6231da03a9c93d6f5579a309
SHA1 2212721f90180965d4664fcece150855d90bde69
SHA512 80b0e1840fc697e6aecc6cf34b0b902071f13598537abce4d8b9c6ce54df5700fcee7210e3143bb9de2e877c852ce13c2588b55962a01a62793db5d3cf6bf019
SSDEEP 192:1ON66wlD/QmiUylACM4X58gZcOKBJsUakwveui/DU6:1ON66kBUJM4X58EcOWJsUaq3U6
TLSH
T163121935F568AC2B5EE2A545F48336139FA55127E6497FD0C6EC2B2C01EE66C130E913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4de7fc85f73c2e556715abdb7be59b3f7ace383703d53e38891410b42b0f8c9c
MD5 05a7b30692f5ee124ad27d0a98173f93
SHA1 7806771b728c47b7567cc325c1f7027dc4eacf51
SHA512 447922786ee506db603234d556df3101486c4135821e7e2bbab5348e0f8f3f712007cb1e4dcee5acd8126bd79a8c37ec756a9c07a968d69f1f933d040560007b
TLSH
T1C2E00453D74411EAC0A91B74508B6F212FE3D1B10BB64366AA2246683EA33607C61B41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b9eb36d92e511b089558929770e24d53d3ba04aa17d4436d21877b0125ff79d2
MD5 4bed78927aeb48f2b5f3ea1f5d2be330
SHA1 6860a77d0baf40113ec986649211f534af6786c0
SHA512 4de93ea26212c547d6e7d8503a2995618fb3e6b18c24af761e8f8b6f11699d4a9bed63110d2b615553a62a6d7e6a93df30f58844f2b02ff56ccab0106ac6f6d1
TLSH
T121E00143D30401EBC0A9177410831F202EF391700BB606569F30056C3EB33507D61F51
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe597d35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597d35.TMP
Size 392B
SHA256 28b90f5415fa0e5c90f4e543920bfc8ecbdc1df0b92f88bd70b8be0d1df832db
MD5 a77e6a9d867dae0888c9fea856236d65
SHA1 c7c3e6510c987af57f728506dc1a2def72c2ce70
SHA512 7e932889002fc9630df2673d463438dcffc7263601955a5496cd6ca50aca9fee4d581ed1115bb3bc0bda27487fccbb2ec192fe8ae1ba839da364607457a9c0a6
TLSH
T146E00243D30000E5C084133410431B001AD2816009B50246993001583D633403C20B01
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 365117de6a5989d31d97c207e030b1f524a3553fc6c819f99bed5dcd411e6f93
MD5 f5e590430da14e51090a4f8ac1029dc3
SHA1 f81ba41bd30e66ae4f01ab660b13b110b6944e7c
SHA512 43ac603b0854cc7081a723168430f2f882ea5625cdb8a25e94f2b3b7757e4145f4aa929f4280ad411f0700b048c97566400b0f53090d626e0332680f98341fe5
TLSH
T113410559AAE91054B3B76E5AABF3696D487BBC372E06D16D10020E4E0A22E00DC72737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download