hxxps://www[.]bing[.]com/ck/a?!&&p=b3c66f03a4d4ccc3afcb22ed80fe02f0ae8ff34d31e44cccc4c823b978c4505eJmltdHM9MTc5MDI5NDQwMA&ptn=3&ver=2&hsh=4&fclid=2224bd5b-33e3-641d-058f-aacc329165f4&psq=what+is+crystalclearcodec[.]com&u=a1aHR0cHM6Ly93d3cuc2NhbS1kZXRlY3Rvci5jb20vdmFsaWRhdG9yL2NyeXN0YWxjbGVhcmNvZGVjLWNvbS1yZXZpZXcv

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.bing.com/ck/a?!&&p=b3c66f03a4d4ccc3afcb22ed80fe02f0ae8ff34d31e44cccc4c823b978c4505eJmltdHM9MTc5MDI5NDQwMA&ptn=3&ver=2&hsh=4&fclid=2224bd5b-33e3-641d-058f-aacc329165f4&psq=what+is+crystalclearcodec.com&u=a1aHR0cHM6Ly93d3cuc2NhbS1kZXRlY3Rvci5jb20vdmFsaWRhdG9yL2NyeXN0YWxjbGVhcmNvZGVjLWNvbS1yZXZpZXcv
Sample260925-19nj3aaa29

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4560	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{33B2FA13-554B-4ADB-8FE6-16284DD8E14D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6260	msedge.exe
6260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3484	464	msedge.exe	87
PID 464 wrote to memory of 4560	464	msedge.exe	88
PID 464 wrote to memory of 3136	464	msedge.exe	89
PID 464 wrote to memory of 2676	464	msedge.exe	90
PID 464 wrote to memory of 3136	464	msedge.exe	89
PID 464 wrote to memory of 3136	464	msedge.exe	89
PID 464 wrote to memory of 2676	464	msedge.exe	90
PID 464 wrote to memory of 1736	464	msedge.exe	91
PID 464 wrote to memory of 2276	464	msedge.exe	92
PID 464 wrote to memory of 1736	464	msedge.exe	91
PID 464 wrote to memory of 1736	464	msedge.exe	91
PID 464 wrote to memory of 2276	464	msedge.exe	92
PID 464 wrote to memory of 2276	464	msedge.exe	92
PID 464 wrote to memory of 4060	464	msedge.exe	94
PID 464 wrote to memory of 4060	464	msedge.exe	94
PID 464 wrote to memory of 4060	464	msedge.exe	94
PID 464 wrote to memory of 3296	464	msedge.exe	95
PID 464 wrote to memory of 3296	464	msedge.exe	95
PID 464 wrote to memory of 3296	464	msedge.exe	95
PID 464 wrote to memory of 5064	464	msedge.exe	100
PID 464 wrote to memory of 5064	464	msedge.exe	100
PID 464 wrote to memory of 5064	464	msedge.exe	100
PID 464 wrote to memory of 4424	464	msedge.exe	101
PID 464 wrote to memory of 4424	464	msedge.exe	101
PID 464 wrote to memory of 4424	464	msedge.exe	101
PID 464 wrote to memory of 3200	464	msedge.exe	102
PID 464 wrote to memory of 1456	464	msedge.exe	103
PID 464 wrote to memory of 3200	464	msedge.exe	102
PID 464 wrote to memory of 1456	464	msedge.exe	103
PID 464 wrote to memory of 2512	464	msedge.exe	107
PID 464 wrote to memory of 4404	464	msedge.exe	108
PID 464 wrote to memory of 4404	464	msedge.exe	108
PID 464 wrote to memory of 4404	464	msedge.exe	108
PID 464 wrote to memory of 2420	464	msedge.exe	109
PID 464 wrote to memory of 2420	464	msedge.exe	109
PID 464 wrote to memory of 2420	464	msedge.exe	109
PID 464 wrote to memory of 708	464	msedge.exe	110
PID 464 wrote to memory of 708	464	msedge.exe	110
PID 464 wrote to memory of 708	464	msedge.exe	110
PID 464 wrote to memory of 1636	464	msedge.exe	111
PID 464 wrote to memory of 1636	464	msedge.exe	111
PID 464 wrote to memory of 1636	464	msedge.exe	111
PID 464 wrote to memory of 528	464	msedge.exe	112
PID 464 wrote to memory of 528	464	msedge.exe	112
PID 464 wrote to memory of 528	464	msedge.exe	112
PID 464 wrote to memory of 4028	464	msedge.exe	113
PID 464 wrote to memory of 4028	464	msedge.exe	113
PID 464 wrote to memory of 4028	464	msedge.exe	113
PID 464 wrote to memory of 4668	464	msedge.exe	114
PID 464 wrote to memory of 4668	464	msedge.exe	114
PID 464 wrote to memory of 4668	464	msedge.exe	114
PID 464 wrote to memory of 904	464	msedge.exe	117
PID 464 wrote to memory of 904	464	msedge.exe	117
PID 464 wrote to memory of 904	464	msedge.exe	117
PID 464 wrote to memory of 5280	464	msedge.exe	118
PID 464 wrote to memory of 5280	464	msedge.exe	118
PID 464 wrote to memory of 5280	464	msedge.exe	118
PID 464 wrote to memory of 5460	464	msedge.exe	119
PID 464 wrote to memory of 5460	464	msedge.exe	119
PID 464 wrote to memory of 5460	464	msedge.exe	119
PID 464 wrote to memory of 5760	464	msedge.exe	120
PID 464 wrote to memory of 5760	464	msedge.exe	120
PID 464 wrote to memory of 5760	464	msedge.exe	120
PID 464 wrote to memory of 5964	464	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.bing.com/ck/a?!&&p=b3c66f03a4d4ccc3afcb22ed80fe02f0ae8ff34d31e44cccc4c823b978c4505eJmltdHM9MTc5MDI5NDQwMA&ptn=3&ver=2&hsh=4&fclid=2224bd5b-33e3-641d-058f-aacc329165f4&psq=what+is+crystalclearcodec.com&u=a1aHR0cHM6Ly93d3cuc2NhbS1kZXRlY3Rvci5jb20vdmFsaWRhdG9yL2NyeXN0YWxjbGVhcmNvZGVjLWNvbS1yZXZpZXcv
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fff7337c188,0x7fff7337c194,0x7fff7337c1a0
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,15770607792381392439,5516439648462210939,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3039436409265057947,15741021131291308662,262144 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,6181667876836812680,859427557508605578,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3131834791445376565,12319826034992967815,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17392493467150922145,1748974658236430178,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,8048774008837258674,5867182883653946247,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,13160216901105124459,8803079295372269507,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3532,i,657550073061879421,8083960614982153227,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,3441740053017707738,6882326566635858575,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13570008419428163061,763005412791353712,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,6199084723490398744,11858716964460563864,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,4312912898877227931,165283886596631489,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,4312912898877227931,165283886596631489,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6692,i,9904842251737551010,10042522649218124372,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6804,i,8059521258477497479,3200511020252956006,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6864,i,363998958564690928,6923762890296895662,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7056,i,1731656330773472095,3925752214035688141,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7180,i,215249336300380041,6869298113767632704,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7492,i,5396842091958001556,9947998295984177798,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7700,i,15246706947063542000,10097422804098549775,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7876,i,4449595362710871079,3619602214745759238,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=8016,i,7143750479849091987,14472806182699421466,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8252,i,15676724745332722562,15207121212783609309,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8468,i,964668443507944487,17428783031520439497,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,1903695241948554725,9653447398486770151,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6888,i,16348035277988405206,5105738286572318044,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6944,i,9162232339490402868,12639070381948133140,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8876,i,8050382398468823192,16998804896410547183,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8984,i,2295612181262706321,1384405247835711295,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6044,i,13152472796383442243,190689134916598720,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9024,i,1002251611252857715,16754016010239225590,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,9573200899588182206,9971635787612921271,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:8
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,16886970073581238410,10637980402686710567,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:6660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,10779245336599469916,2043573436267818615,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5636,i,8680081955163902053,1927685055661777124,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5700,i,11743519056174831761,4968236620048798839,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4224,i,2372427859566508528,180584259144175071,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9336,i,13941326040348993851,7404481907430192817,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9488,i,4628759869859488441,6632284912427433873,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9376 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9624,i,13775811678112915258,14671252833079353863,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9760,i,17177764212753889648,12613062755760209695,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9772 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9924,i,8774002636091957572,537292320032418463,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9936 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10056,i,13801763243043225132,16965694323299857202,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10204,i,12833863904406231305,12827761279235819470,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=10200 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9660,i,6384463409331020433,8889018488933051116,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9740 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5428,i,10464913359161184709,4079363614943938500,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9636,i,6037771193631632812,7340900871663914015,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8884,i,8892138573338590554,14381773177010743110,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10360,i,6991280206226973561,10108544671044745201,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8880,i,10341198257614976734,5018828041037843478,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10160,i,17269028258359849964,14328582078364537924,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9428 /prefetch:1
  2⤵
  PID:6672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10152,i,10728687316806980505,9358358863128275049,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=10196 /prefetch:1
  2⤵
  PID:6844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8916,i,7082655579629963942,15139017445280879275,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9224 /prefetch:1
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10192,i,9539906927034280127,2610745164486357351,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,8849715051547989953,17073374890398807275,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:8
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=5512,i,7035951943951421366,18208637988937316974,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8208,i,1121729295850579583,12810053721129697888,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6148,i,11989905563597870515,7546147019829435750,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5696,i,8765547572810519316,7027556995362454968,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5688,i,13374175648477098375,1691753615050610482,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=4540,i,11608400534855541587,3606901824073622936,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=10076,i,10854113289790536396,5169823431454579992,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=10612 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9544,i,15076796193946630209,10680443400425454599,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9792 /prefetch:1
  2⤵
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9596,i,11049663454175959989,16811832292793836750,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=10404,i,11317501123180477604,7680376963791156789,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8480,i,9109827812860209995,13902655593587849795,524288 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7004,i,5681010256659903760,9278784692198981745,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:6752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9520,i,12036425520329416827,10081891699821895284,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:6896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9364,i,3111140064398491769,1224620451454782608,2097152 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4392,i,296714269941809053,13563761301300473157,262144 --field-trial-handle=2352,i,12395855597262328154,9463202056004953671,262144 --variations-seed-version --mojo-platform-channel-handle=8236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ca854d2-9095-4f27-892d-1880baa04bdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ca854d2-9095-4f27-892d-1880baa04bdd.tmp
Size 18KB
SHA256 a5b26efab9658274964df708137d1d063aa89fa7a25d2dccfecc5d62ad475f05
MD5 fcd390ed85703d493a90f5dc5cb3d1ab
SHA1 3433cb79fd2e2b1f012d097779fc0583441c036c
SHA512 b9b1c6393c642a843e4f159fc57f191a108b20e8300ceae085612cd55221eab0462c3542165074c7704f56de2302f5569d3d2e7cb89df8270d0c0bc841aad37f
SSDEEP 384:BZcIhsNSvpyFIbTLch//WIC18QltgOIwZOyXPnoA:JhlXw/hyXseL
TLSH
T128828D765878AC7B5DFBD594F04736035E7844A7A6C99F90D5ECAB1E01DA0E4130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

80d1f187-b88c-436b-950a-a50f65565945.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80d1f187-b88c-436b-950a-a50f65565945.tmp
Size 10KB
SHA256 72191a1ce13158e21bb838eab3ca01e738ec3ca553376b09e198fce39dea0c6f
MD5 6cada9f44184177cf4a1dc9ad40a18f8
SHA1 2a62015d7edcc4b0537ad6600e668680bcf06adf
SHA512 07a9faba8c82dff9e20ab3b07ab1fd9c67d4af88caba3a505e7428d6ebd91ef149169938ac1503a02ebc6eb4c4f5e918ada1094d9511fff959773441120ea502
SSDEEP 192:sxZKR0Wj/fwsZIEIdpTqXHW6+WN/SndY36KIxK3Ig5oJ:sxZKhj/fwsZId8HbMdXbKq
TLSH
T10F22C95A6E34A57B8CCBD20DBA15BF13D6FA503395E51E88A6FC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 23KB
SHA256 0f8b4794ccfacc77ce3b776b91401142f01e657bf2580a533aad6c0aa2043142
MD5 147437dab863b8b0a4f56967319a78d8
SHA1 e0882f43c16adb6b388ea21f24fac7d04106a3fd
SHA512 0b94fc068df71136e6de94904b5a4fd846b9c4304105be8e44dd5e80553613d99f25d4164d556ea2a69b9ac0919166bbb4b55c4c7be1df52e6cd075ebae8f695
SSDEEP 384:XMWgSF9GQuNERzPxQutjrSvdxsjCAVoUm2cWKA2uuf89V3lxy6PWb9RKSjzSAnb/:8WgugJNEsijrS7sjJVoKsA2uooVK6+bZ
TLSH
T1B8B2D1696CA05F319220BA07BF97E0B11B78C3460316034CA3257E7E7A477D9D887D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 1024KB
SHA256 5af2ba2d2c12a275cfe2bda4d3ec4ba6fc49aa44cb546da5037e877e5af6adb4
MD5 879c5f4675d67d706c8ec0129a10523a
SHA1 913e484f51f63f986b528f89a08626cd3405b01d
SHA512 59ac7bb084f9bd34602e067445238e51669dd35e5468cdb8254d8b7e5a61fb726f144cf7c617f989490f21c9a201b0b154dbe15837e0657c6c2a2f4bc7883607
SSDEEP 24576:Th4pC14pKtycr0V9w/fo05IQUj3y3JPc2:T14pKQm0E/Q06N3y3y2
TLSH
T1302523A306E4A156DBF29075E4F8C540705D1C2EED25C6E73AB4B815FB368B563BC20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 f6337af9287f6969727a24b8384ca9f4c1e0ad60f71c82ed5065176473ae8f5e
MD5 666576a85727152300ce78b755a54e38
SHA1 06e0e7f3b6edfe052fc6f44581a1fe646254afd5
SHA512 9f120510d0b3a980d9147b1c3a0d93c738eede0f3b3594aa44b00563b587275f06641baca87e553a212b86c5db92be535eceb8cbe2b8a3080c114dace1c1816e
SSDEEP 96:yHy+negoRhnJ59GeEyTR+nY998hwmKj+vzMRwINp9rlQhxnXvknRNVSU9B7LVwRK:yHy+ezP5g/y1+YHkwmO+rswINTSfkRN7
TLSH
T12FB160FE92D414A2FBABF078D5CC6A87B532998C198FAF833612C6768007BD116D0B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 11e3e105536f162a0d187863b4dfbd03aa383b3d0620a92f6bb927c408f864ca
MD5 b72562018207fd75d8d11180e6aa97a6
SHA1 fc5fa5ebd2140b9767459fe9ecc95f754ab9ba55
SHA512 5e92da013204c9c6a23f40d668127d2ec6ad5ff4f69aa5af3f8b36104348deb41fb7d89efa66ac2518b0510cfe798cfc8357bf6689da673e37d8035711fed39e
SSDEEP 96:Ty+YgoRhKJ5NGeEyTPnY998hwmKI+vzMRwINp9rlQhxnXvRnRNVSU9B7LVwRXvLX:Ty+Yz05w/yzYHkwmN+rswINTSfRRNVSR
TLSH
T1EAA14FFD92D010A2FBEBF038D6CD6A87A232598C194F9F933612C5768007BD116D0B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 ac852e299bf2b7201d3538df4c9a18eb6ec128633bdd4e5c26a9b1c81d367aa4
MD5 f9eb772c830fbda0ad1b1c285a6c1724
SHA1 6b3018fabc1c2914bf20d93954a78d61fc744969
SHA512 5625ec39fd5a05cdd78f69cbb885025874faf6d097b4f09154660679f5d195fab3e84a596bfa837816baa934499ea077b8a5cfbc2c14cc99b1c7cd30235e9ce0
SSDEEP 96:4y+negoRhnJ59GeEyxR+nY998hHmKj+vzMRwB3p9rlQhxnXvknRNVSU9B7LVw6Xx:4y+ezP5g/yX+YHkHmO+rswB3TSfkRNVP
TLSH
T103B162FE82D414A2FBABF078C6CC6987B532998D194FAF833616C6769007BD006D0B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 686903792251ff0788f49fb3948e747548cd29f8c9db9123e035efe2847aa4a6
MD5 c4be9d765c763ede636a179aad232d26
SHA1 78495021d5b95c869615ac29a70d0d18b711eb78
SHA512 e3336db8a6b16fb401225d2b364cfb8b8a3911c4ca108e6f990ffbac9cef74dd6404fd329dbec3845005a7e01d5b92eb250e0c437064a6c19507c5a0cdb98909
SSDEEP 96:MUy+negoRhnJ59GeEyTR+nY998hwmKj+vzMRwINp9rlQhxnXvknRNVSU9B7LVwR5:MUy+ezP5g/y1+YHkwmO+rswINTSfkRNo
TLSH
T186B151FE92D014A2FBABF078D5CC6A87B132998D198F9F833612C6768007BD116D0B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 40KB
SHA256 8b48b268f1060ff95c6eec55f2318b808f772ad192101fd5e571d5f552a130d7
MD5 902e90a1bf7d3828ae84c124116db6ba
SHA1 7c800a8456270d24cfabfaa3c48f999bb589b76d
SHA512 34cd02bc9972e95fb6dd788e6170a1a9e54763059530ef158aaf523a4db7637f3f9c4f45611cfa7c818110da218cd14f3ce1f3c4460721437cbdc9253a6589c1
SSDEEP 384:DkyaI3IKktQe5eWy+8JOTZn2lK+XJu7lp8Be5WeaongeteiUjJo8MetiZ80Tg51V:1rTzs6LrHb7bhgPqrtrfdcyfd7v
TLSH
T11A038CB7C3E4472DEA1266F0A5542E129E6E053447DC3896C1ECAF4F97F2672E28350E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 710caff232d6a7e2bcf0a4c3b979a56a14b91c9ef711357f9728826b4e57e162
MD5 6222e5fd854f02e5398eecda8520893a
SHA1 2673e4af19c63c106cd31d301a1120154a19d0b0
SHA512 9ed11373985c296d092ae208e460977f8872782bf16762ac059f44b3268751bdbcca2f141d3cd1155b926b2be493c5d3370dec5028fe437ad5fdb2763ebed157
SSDEEP 192:sxZKR0Wj/fwseIEEdpTqXHW6+WN/Kx/Y36KeK3IgrJ:sxZKhj/fwseI78HbQ/XrK9
TLSH
T1C222B8566E38A53B8CCBD20DBA25BF13D6FA503295D51E98A6FC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 37506eeba072fac8edf8f6fd3f6d4712c005c7543bd31b90212f7636afc3b5aa
MD5 e6c8dae39f5ef0d7f5281c3f671d6345
SHA1 50fafd43e7ea7eca8684255cd238537af1a6ab43
SHA512 ffc01efb27f0f69302d72ea3d5052e1b284ff42e4ef68326ceb33a6f295b81cd64f915c2e8a5854b8e72a7561cf08636e0bcfa3e2dbb2e47bf62b5ac70fb8597
SSDEEP 192:sxZKR0Wj/fwsTyIEIdp9qXHW6+WN/ng5Y36DIxK3Ig5KJ:sxZKhj/fwsGIduHbo5XUK4
TLSH
T1BA32B95A6D34697B8CCBD20DBA15BF13E6FA503355D11E88A6FC861C05E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c24bfa2b8fa6701cf23660ade08f72343a1b79321f9c51e3885a178b91f01c15
MD5 4420386a2137aa72b7d2b45617a19f37
SHA1 f0ebcf9dcde1f4bbb90a56da062cf32d743b59e9
SHA512 61d1923df004e3e6079b2bd55ea54ae47fa4c20671f47154f2d47193e925dace9b4c1d00476a0ef7e9f9f9b6980ab2030a28ebfe4ad90b2b4740b7cc87c6fc74
SSDEEP 192:sxZKR0Wj/fwsTyIEIdpTqXHW6+WN/VCtY36iIxK3Ig5KJ:sxZKhj/fwsGId8HbstXjK4
TLSH
T14322B85A6E34697B8CCBD209BA15BF13E6FA503355D51E88A6FC861C05E66CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9dd7f649e1d14b3dfaccf76bb6924799e34ccbcef0b60a606b490e269942fbb5
MD5 43de01af38a9cdfc3ec0524145899766
SHA1 6bc626f1d92fc5736c3d43554f9b26de6d5709ad
SHA512 9ebe2709b41ded0ad810781db29a946dffe2c530ce966df7df8f97384b81f45aae357f181366f41cce9b74a293639a9b89436ec0ac69c2803c6539e9e396919e
SSDEEP 768:keKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/LronYr:keKlm7QWvUYm0u1ja8/L/E/4nYr
TLSH
T103C2FB3B640CCB7E4FC04A9DDC5A6F972EA802C796588D404BFA994C02C77EA91274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4caed165db1cc038_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\4caed165db1cc038_0
Size 64KB
SHA256 5d64affce1728ede6bb91e6a88448bb51e6482faa36ea01ceae76573f80a67b4
MD5 f6f316d383e20f56e66c0d201719d12a
SHA1 31e8d8df266b74fb710d5ebb3418c1c1782e8cd6
SHA512 d05b10169e89e4c7c14e7fda87b22840b73fd18838c6dde9f3723235a04a275ba258499b4559899161d85a0025e10131b37ca7697a7f405d61ce2f03783212fe
SSDEEP 1536:UvS8fe5uWXSUiJCQpygYh9kN2oPipx0TrpmVniUPQ:/uHESppJYHkPi0pzU
TLSH
T122536BD93731B4B383BB61F1506F120B713EE567B404C4A4B198ECE55A54B6A02BBFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ec32c273fdea64ddc60f94638b35629650a39e25d58578cb9409f68fcf2dd051
MD5 085e9742b5c985f1abd7d59603513fd0
SHA1 9abcae283f86572bb0a95e37dc82ae413377f22f
SHA512 b01acc4c3426c313245bcbedc382d90dae838a0f9466f5a488754bed61e2b11b259373f0c53883853d9e54fc23a91f3547b78d829fedabc6d4d67f2498e6744f
TLSH
T1A8A002240B546042C0C88AB5A5D657853760D8740105B713819845A49C54AC04DD5A40
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 de0060ddc901e0634c741ef1f3e09d0eccdcae9612ead0d61a2c0a491321845f
MD5 1529c099d57faa57cace4de3a94a4cf4
SHA1 e013792d75f120dc354a8ba79a76522b2dde3d0b
SHA512 2ee1240f21de7fee9f975048f7b3bac486e42cb6aab77bd1c1a5548bf0375da8a79842195a73c3f0c6af50eb7033d07be6742472923ee7ee6a670743f44a83fc
SSDEEP 96:KIZCK6QK2/eKgIIFQXj9ff92LCwsb9KU8sd9A1d6rfGhFQXj9ff9z:oh1BFQXj9ffULCfbR8sdq1d6rfGhFQXf
TLSH
T1CD91450130BB164039BD694892B09A6FD54136F33018E96B7BACA4E64F6EE181DFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 b0b1b71f9477f45f1fee4fad442f9ffc12524f1026936dfbcc9f4be6716ceeb1
MD5 8cc575636968178dad8f1e05504b52e1
SHA1 6157ebd6cb049e4e8a0e639f10a0407565e4771e
SHA512 379a7028c0b8e77ef87485522259174e6f47f77739be8e71f708e8da20b5fbbbe7223bf39f7d36eaeb0cd6154e186ba499d576edfaeeb8c106c524f194fec008
TLSH
T138C08CEB002894DE0670AAD42020371CE54FC28C8CF5ECECA84481866138D234603970
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe592987.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe592987.TMP
Size 164B
SHA256 6446001fd497c116e8e46afd50fa67db10ce600dccbe676f34b00e9fbd1e1ca8
MD5 106c9168e29c24d5b81c028a831c483f
SHA1 88a39ab45eab640cb1077756f79400cfaf9d87e8
SHA512 252c13d560a7b2d599f0a7677a646b542b98d2e57fc60ea2425b8459586c2275e9d28b26dd4a4de18a86953bbb2fca04c12d7be40c66066cd86e6a5144bef554
TLSH
T13EC012AB002884AA06B1A9D02020364CA55BC98D8CE4E9E8A846604661389238603960
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 73623cfa69e8bcd0aa56d5abf4d242a49761a2adc1a2b2944f9ade7bc16a6766
MD5 88ca5abce1f43c1177d1844ae5ed5ec9
SHA1 ab1c443c9b75f298dcf5cc6526824f11abd5cbf6
SHA512 0750ee36df5046bb09e2b3911ac707f002abee98119c4f9c81f997d4ad22f8beb738baa173b1b27b596acf4f1eb1f5b830fe1b6f080af1ad77dba0906c92c378
SSDEEP 96:KqONkLQsjpfbUmjH5ih/cIPURHl8h4otop5GaD+BKP4v+Y1xf//ojdhxlDeYu7Mu:BONz6JUm0QmiUyb+so//WA7MBCeqPU6
TLSH
T12B02D739AC68BC7B8EF39E45F04777239FA4106BA6951F80DAE92F2D01D755C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 659ac733cee420c8b74303396e573108187ba0aa21ba1bb909355b4f34dc9251
MD5 20ec186072cc16e706ffb6cb1afb67c7
SHA1 3dc5b5038f33f38783a254c87b5ffb1940fd444c
SHA512 c0269cc85d59511cfc11bf969f3cff39cfbf93671288c96e7107f23249a0e12569d1b4714fd5573260fb40e020e6c6e3cf26a305af53af4d5212f8e6b1428284
SSDEEP 192:BON2e6JU0QmiUyF+Mo//WA7C1GeziNxef/rlU6:BON2e6+EHMo//WIC12QlU6
TLSH
T1B9120A36A864BC7B5EE3A994F04736139E744167D7896F90DADC2B2D02EB49C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 89f33bf1213b31c05a678059affe3c97f11129e35622477247d659b801a61eff
MD5 2e98cdcdcc48f3d0139190275bf886b7
SHA1 6cc0f1d6ac9f9df6dc136795ef26d55466ef9f44
SHA512 8bb6ac725834729bafee62b497e9b5228480b40a28f876de942104476de27d0774f20fb3733f1919a0feec3813c5bf662fb9b53855adc63e3d9405bd4b2df31a
SSDEEP 384:9ZcIhsNSvAyFIbTLch//WIC18QltgOIwZOyXPnoA:lhlQw/hyXseL
TLSH
T123828D7A6878AC7B5DFBD594F04736035E784467A6C99F80D5ECAB1E01DA0E8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 d17c81b32ecd86d902642dc42ec9a26f9a33c369b1a8f70b7002a62c048282c0
MD5 2751def0f0741fc45c273ee9beebfadb
SHA1 c9380aa5f928c15081939ef84a37694d06166a1e
SHA512 02a1172d101b9e60f7c3dea646b616e88a8b92d96a9fd591be78dc75b36a275827de4f48bcecc70d0977281f1ac9896aaca908c17dbaeaefff5e4111e6104576
SSDEEP 384:NiFiZcIHzsNSR8TUNTUlIlAyFIbTLch//WIC14QltgOIwZOyXPnoA:EFQTlRwgKw/DyXseL
TLSH
T1A2A26C7758A4D87BADFB9A84F54B32038EB444A7D5D6EF90E6DCAB1E01D60D8130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5220f5c6-252b-4871-8e6a-1d41fcfa3672.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5220f5c6-252b-4871-8e6a-1d41fcfa3672.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7865ba8b873eddc1f8abdf4ce752ac6e88a0f56b430a581faff772cd0293f11c
MD5 0fe4233f2a6d772518dcadb36d3bd1eb
SHA1 a5057f6f79b2e41f9fca57d1ffcc60733011bc6e
SHA512 bdcb111b3f9677383e477d6fec13ec8eb19e6c69a8228d388b8956de29daf0d02dfc994896b313917ecb65638c51c529abd29fe35c8bf6e844aebc91d672fe26
TLSH
T120413A5CB6E91148B3B77F1A9BF6A8AD487B78772F06D45E00110E4F0A22B40D9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download