hxxps://sharemods[.]com/w5yca5mq6p9k/OMSI_2_-_Addon_Citybus_O405[.]zip[.]html

Resubmissions

18/10/2026, 14:11

261018-rhhease15z

18/10/2026, 14:06

261018-rerhssez913

18/10/2026, 13:52

261018-q6gbgadx8j3

18/10/2026, 13:44

261018-q114paxz7q7

Analysis

user interaction
yes
max time kernel
169s
max time network
171s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sharemods.com/w5yca5mq6p9k/OMSI_2_-_Addon_Citybus_O405.zip.html
Sample261018-rerhssez91

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2396	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{D03F2D03-AC4B-415A-997A-3D5558C8B638}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OMSI_2_-_Addon_Citybus_O405.zip:Zone.Identifier	msedge.exe

Runs .reg file with regedit 2 IoCs

pid	Process
7676	regedit.exe
6576	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6504	msedge.exe
6504	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 4972	5964	msedge.exe	81
PID 5964 wrote to memory of 2396	5964	msedge.exe	82
PID 5964 wrote to memory of 5856	5964	msedge.exe	84
PID 5964 wrote to memory of 5856	5964	msedge.exe	84
PID 5964 wrote to memory of 2724	5964	msedge.exe	83
PID 5964 wrote to memory of 2724	5964	msedge.exe	83
PID 5964 wrote to memory of 2724	5964	msedge.exe	83
PID 5964 wrote to memory of 4892	5964	msedge.exe	85
PID 5964 wrote to memory of 4892	5964	msedge.exe	85
PID 5964 wrote to memory of 4892	5964	msedge.exe	85
PID 5964 wrote to memory of 4392	5964	msedge.exe	86
PID 5964 wrote to memory of 4392	5964	msedge.exe	86
PID 5964 wrote to memory of 4392	5964	msedge.exe	86
PID 5964 wrote to memory of 5308	5964	msedge.exe	90
PID 5964 wrote to memory of 5308	5964	msedge.exe	90
PID 5964 wrote to memory of 5308	5964	msedge.exe	90
PID 5964 wrote to memory of 3896	5964	msedge.exe	91
PID 5964 wrote to memory of 3896	5964	msedge.exe	91
PID 5964 wrote to memory of 3896	5964	msedge.exe	91
PID 5964 wrote to memory of 6112	5964	msedge.exe	92
PID 5964 wrote to memory of 4132	5964	msedge.exe	93
PID 5964 wrote to memory of 6112	5964	msedge.exe	92
PID 5964 wrote to memory of 4132	5964	msedge.exe	93
PID 5964 wrote to memory of 2364	5964	msedge.exe	94
PID 5964 wrote to memory of 4080	5964	msedge.exe	96
PID 2364 wrote to memory of 1592	2364	msedge.exe	97
PID 5964 wrote to memory of 5012	5964	msedge.exe	100
PID 5964 wrote to memory of 2548	5964	msedge.exe	101
PID 5964 wrote to memory of 5260	5964	msedge.exe	102
PID 5964 wrote to memory of 5316	5964	msedge.exe	103
PID 5964 wrote to memory of 5316	5964	msedge.exe	103
PID 5964 wrote to memory of 5316	5964	msedge.exe	103
PID 5964 wrote to memory of 1288	5964	msedge.exe	104
PID 5964 wrote to memory of 1288	5964	msedge.exe	104
PID 5964 wrote to memory of 1288	5964	msedge.exe	104
PID 5964 wrote to memory of 6048	5964	msedge.exe	105
PID 5964 wrote to memory of 6048	5964	msedge.exe	105
PID 5964 wrote to memory of 6048	5964	msedge.exe	105
PID 5964 wrote to memory of 4640	5964	msedge.exe	107
PID 5964 wrote to memory of 5576	5964	msedge.exe	106
PID 5964 wrote to memory of 4640	5964	msedge.exe	107
PID 5964 wrote to memory of 4640	5964	msedge.exe	107
PID 5964 wrote to memory of 5576	5964	msedge.exe	106
PID 5964 wrote to memory of 5576	5964	msedge.exe	106
PID 5964 wrote to memory of 2036	5964	msedge.exe	108
PID 5964 wrote to memory of 2036	5964	msedge.exe	108
PID 5964 wrote to memory of 2036	5964	msedge.exe	108
PID 5964 wrote to memory of 3852	5964	msedge.exe	109
PID 5964 wrote to memory of 3852	5964	msedge.exe	109
PID 5964 wrote to memory of 3852	5964	msedge.exe	109
PID 5964 wrote to memory of 1192	5964	msedge.exe	110
PID 5964 wrote to memory of 1192	5964	msedge.exe	110
PID 5964 wrote to memory of 1192	5964	msedge.exe	110
PID 5964 wrote to memory of 5328	5964	msedge.exe	111
PID 5964 wrote to memory of 5328	5964	msedge.exe	111
PID 5964 wrote to memory of 5328	5964	msedge.exe	111
PID 5964 wrote to memory of 2632	5964	msedge.exe	112
PID 5964 wrote to memory of 2632	5964	msedge.exe	112
PID 5964 wrote to memory of 2632	5964	msedge.exe	112
PID 5964 wrote to memory of 4760	5964	msedge.exe	113
PID 5964 wrote to memory of 4760	5964	msedge.exe	113
PID 5964 wrote to memory of 4760	5964	msedge.exe	113
PID 5964 wrote to memory of 5728	5964	msedge.exe	114
PID 5964 wrote to memory of 5728	5964	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sharemods.com/w5yca5mq6p9k/OMSI_2_-_Addon_Citybus_O405.zip.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffeb915c188,0x7ffeb915c194,0x7ffeb915c1a0
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,13197406483415502716,10315245185410447941,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,7251340190350376235,13854047107182365903,262144 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,582395522046508283,6326683268894223696,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,14652099187483408026,1605527756408046828,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,2257929366432622891,669576579954012429,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4984,i,17065331233893399904,6385339978014787282,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5108,i,18205993314007818827,12555985728387991183,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,15277150685844144632,12244749119959594866,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,15757041060276139287,2294860354876314814,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8388335158873992427,16185325179890245865,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1112
    3⤵
    PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1444251498909980943,13061388342335128021,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1444251498909980943,13061388342335128021,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16071461118425716195,9453077017973348765,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,3007184041302724570,894907883892972739,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,5241678378223789605,12424188032402492431,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6392,i,6888562646973867746,4153446522849083032,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6952,i,1963325446555650243,11809935041295052944,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6828,i,9162882127170319921,14776674999356342285,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7204,i,2400498994406740328,10269306010104941236,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7212,i,13088758143311625504,9457240153258844303,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7512,i,4878570551819333503,1364197219162528171,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7580,i,7660271528051468727,118506273867831499,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7852,i,15208401985652502635,10678873658486185914,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8000,i,2511872757684944542,18232282140725815586,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4364,i,8534655876502402589,14893668918828515167,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8316,i,14367867299004583441,2085894343188777962,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7072,i,2927782973863832204,16200290188703817684,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8640,i,1847121950864233545,609793958882309557,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8796,i,4178364485763766632,12551627669034411659,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8664,i,5036739191589277743,9597652082101734225,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8872,i,779820942372426168,17493785864674408693,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8888,i,13546188528417262425,624467301271038600,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8920,i,12883064524567692268,1455114978340636547,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9596,i,3841368454788401571,17806676331902939315,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9816,i,3225454929230986328,15373812837503766488,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9924,i,5857181740184765966,3026511626142357513,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10028,i,1672555791059005702,1839212677067272408,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9020 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10056,i,773117064113197543,11572756568761680617,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10312,i,2544735029928139682,15147706725000155284,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10328 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10356,i,13537570347165894886,9528606559585071340,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8300,i,1717565630199767180,12449097547462536414,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10768 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10872,i,1134384878515932494,5575583523022063349,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10748 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8300,i,2775872108254366941,12232445495638832811,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10960 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11140,i,4042457243680961944,12517080037389209922,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11136 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11296,i,7051443439363599409,9960692736819900675,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11300 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11420,i,4303593413423972319,761253756662490650,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11584,i,15657015755763657739,4018419441828716649,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11472 /prefetch:1
  2⤵
  PID:6184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11604,i,18069297694122724486,16851892093034154498,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11616 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11188,i,10969190440592073367,829851711940733824,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10872 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11584,i,15304471006139252114,15427876207175363700,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11856 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12056,i,11464596787309300752,8277802731038320483,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12188 /prefetch:1
  2⤵
  PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7288,i,3899119664006278369,4562344383078789953,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=12364,i,1808738058782852213,8560924677698170728,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12008 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12488,i,16030772547609543566,8794476944424446644,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12492 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12628,i,17178316910666129037,13103480038923132098,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12632 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12804,i,23813196148893479,16277807005848669731,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12820 /prefetch:1
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12936,i,4137392894803034113,18107281803752900544,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12916 /prefetch:1
  2⤵
  PID:6660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13064,i,8139754680678096191,16839511414082493280,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13072 /prefetch:1
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12908,i,5195881390423756404,5876432153225287616,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=12804 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=13288,i,8112807495794571897,18171051629136767791,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13320 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=12472,i,13247714350039477635,735317460493440405,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13364 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13660,i,4080693419885869047,7679693318640126513,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13644 /prefetch:1
  2⤵
  PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13688,i,7022673060050150863,2000284331595063482,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13284 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=13628,i,16142722567954334165,12654579498412667019,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13944 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13604,i,6097292747869686325,4236991821469888436,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13588 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12616,i,6672734524427203956,12124880104588891111,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13920 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=13624,i,17440607054856967585,1208847925395293635,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14028 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=14032,i,663549468368240296,17741896725424580810,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14036 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=14068,i,10252919746430169328,15126065091740106791,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14084 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=14868,i,13645409918638921037,6200685376428713878,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:1
  2⤵
  PID:7328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=15000,i,1648152367937050191,5409750618615868844,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14876 /prefetch:1
  2⤵
  PID:7336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=15120,i,9369796484723726859,3771571204691782548,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=15132 /prefetch:1
  2⤵
  PID:7344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=2460,i,12877872017583382716,2883479121487870853,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:7352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=15368,i,1536274738340026838,8663874803138399636,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=15372 /prefetch:1
  2⤵
  PID:7360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14452,i,12326994952599416726,17947568021702083306,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13584 /prefetch:1
  2⤵
  PID:7368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=15644,i,13842125644467910039,12959842460621619013,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14344 /prefetch:1
  2⤵
  PID:7376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=14020,i,4724640176179315345,16993470452807172711,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=15780 /prefetch:1
  2⤵
  PID:7384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=14996,i,15869774337428361185,8578249090467179205,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=15756 /prefetch:1
  2⤵
  PID:7400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=16028,i,10887996947284206098,11750826632542811860,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16020 /prefetch:1
  2⤵
  PID:7580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=16192,i,14317531941093663210,16460044100512203343,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16200 /prefetch:1
  2⤵
  PID:7588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=16364,i,4888104866126234219,11146646002105393433,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16004 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=16528,i,13893409776004425337,6412353050957177658,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16532 /prefetch:1
  2⤵
  PID:7700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=16648,i,12892203684880756420,16402209153156747483,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16660 /prefetch:1
  2⤵
  PID:7708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=15644,i,12326811748815974593,8475529306941951257,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16832 /prefetch:1
  2⤵
  PID:7728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=16944,i,13099136883200334039,6201818150326769214,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=16068 /prefetch:1
  2⤵
  PID:7736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=17024,i,1502925249900405193,4567839295684924835,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=17028 /prefetch:1
  2⤵
  PID:7744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=17160,i,17045830437363022193,14703061827304936897,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=17164 /prefetch:1
  2⤵
  PID:7752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=16724,i,17185163457618479951,14230196921370473908,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10688 /prefetch:1
  2⤵
  PID:7988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,16472620711298600958,1588187056370761551,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:14
  2⤵
  PID:7884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=7236,i,5386457685370501471,14941415346452421284,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=15576 /prefetch:1
  2⤵
  PID:7928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=11572,i,16597843604100572489,5567508799441303821,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:1
  2⤵
  PID:8072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9500,i,9271239371668377061,6484756226745992272,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9468 /prefetch:1
  2⤵
  PID:8128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=14108,i,10422738666184166071,3235356359910422173,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
  2⤵
  PID:8136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=14600,i,5112695114987852775,6496566016213499681,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=9472 /prefetch:1
  2⤵
  PID:8148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=14640,i,11792756166177959702,10918624785869824041,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=13600 /prefetch:1
  2⤵
  PID:8156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=14624,i,7060072404383176181,4770476817417162126,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14004 /prefetch:1
  2⤵
  PID:8160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=14572,i,5934259973349528560,18209274641464197904,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=14052,i,15094244231481564805,10625098945205816702,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=10176 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=14888,i,14310727012686182681,1476114496036237358,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=14656,i,3142438101777473922,1232767701649351291,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11136 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=14884,i,13525847694663270952,1143418073796654510,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10044,i,16810543863486926683,9522284252935430592,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=14760,i,1241367016351603662,9668090968513493559,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=14652,i,12678974247481878043,8355772650005830955,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=14948,i,6554079060040982550,10289988821470928384,2097152 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=11144 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15100,i,10379735496740630401,12756117243752305714,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=15032 /prefetch:14
  2⤵
  PID:7728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,421780368818607117,8566648273333650887,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  - NTFS ADS
  PID:8008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15572,i,10601678466829182499,4398122949143595316,524288 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:7576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5568,i,9071459370307597363,7567210222750974030,262144 --field-trial-handle=2544,i,1035543228731977177,1282028813344807976,262144 --variations-seed-version --mojo-platform-channel-handle=14904 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3792

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20261018-1507.dmp
1⤵
PID:6288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6252

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\OMSI_2_-_Addon_Citybus_O405\Key.txt
1⤵
PID:6840

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Downloads\OMSI_2_-_Addon_Citybus_O405\Registry for win x64 (need to change the game directory -Product_Path).reg"
1⤵
- Runs .reg file with regedit
PID:6576

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Downloads\OMSI_2_-_Addon_Citybus_O405\Registry for win x86 (need to change the game directory -Product_Path).reg"
1⤵
- Runs .reg file with regedit
PID:7676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1cd25fea-b188-4413-96e2-0467d922a3e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1cd25fea-b188-4413-96e2-0467d922a3e1.tmp
Size 32KB
SHA256 064b793b2891e4ed80bf5b82f124ae89461b4c1f1e0e3184ac7b14990604c0fa
MD5 6b9acddd64c171aadcca559622f06553
SHA1 f5fc8b4ad5de1971b3254c085f61c1f489b0f27b
SHA512 fdbc84050636d8d3341fea6561203516ad418a04fd3423499de6bc2a73384b76a6d65d0c897790a64891800103f1d14c3a2515ddf91be8345f226de73ff53742
SSDEEP 384:nliFgQkUSvI8NM8TUNTUlIRxQnhxANgtzTfoB/7yBxVB6P7PoJvVBjojNGMT4gL8:sFII3wgaheiUB/703B6TP4SNGMTDLQ
TLSH
T158E2A0F5A8E78977E89E4B57A77D2D42A9BCC153B4884A84F7C44D0CCC821BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e62b3eb-56e8-4558-a3cb-1d67dfe871c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e62b3eb-56e8-4558-a3cb-1d67dfe871c4.tmp
Size 25KB
SHA256 2fad70caab3ae6305b371fddb3c55cc17abba51cc71572631009150c48a7846d
MD5 d078a8e10fcae3779b9c4907c775435b
SHA1 7cc1604220f0257ea34d27ae1b4a7d858b6d9290
SHA512 95fb9d13da8171ce4399450f01de47a1b4bd761e8afb4fd9c7c097f161cd096e433776ea8f74b8ae39c412ab6feec64c30330aca224153039aa00482dceab606
SSDEEP 384:zziFiZcI638NF8TUNTUlIxBQnhxqWhitzTfoB/7yBxVB6P7mNS7O6R2Feo90gL/n:aFQ63uwg2hNh8UB/703B6TmNS7TR0qU
TLSH
T135C25A36ECA4C9BBECEA8EE9A74A7606EDF04163C58C9AC4D5DC5D1C009B5DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34c7fd64-066d-4432-853e-31e054ceebed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34c7fd64-066d-4432-853e-31e054ceebed.tmp
Size 27KB
SHA256 ad31d2bc62301f3ff4f68aadc49053a49663129fa13dac813b01c62de07d3b1e
MD5 2af25e000f871e86efe8458a53209f89
SHA1 abf823ff7ec7d7a0ec38e03d3e37fe8694ec7a0b
SHA512 75eafc3f6dc1f2b6c1d3e387887cf3361019476bf08af5f51b06b424152aa6fb70910923aac389d21b7e909296e5695e9c46d67c95589c549d8ede8cb6999878
SSDEEP 384:nXiFYQkUSvv8NM8TUNTUlIRxQnhxgFgtzTfoB/7yBxVB6P7PoJvVBjkNGMT4gL/U:SFQv3wgahGiUB/703B6TP4INGMTDLQ
TLSH
T133C24B35ECA5CDB7ADEA4E99A75D3647EEE00163D8884AD8E6C94D1C00872CD270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

768ab7eb-03c1-4d5e-be8e-d71008a88bf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\768ab7eb-03c1-4d5e-be8e-d71008a88bf5.tmp
Size 25KB
SHA256 9f74ec23118c14c42788129db4d7cc8fb08e1d69d4b2d43e3ed1db4103ef00a1
MD5 61b9606d931ec84d803b845e13d28b20
SHA1 a14bb9114ece566a3c887b14c3764403dd6b6474
SHA512 ed5d8b381603849713105aecf10b7ee47a64304652c2be611c6f6b6d17671a0f1b89be58097a399ee6e9e9263409fd27c7cf704cad74cca36df327854bb6d073
SSDEEP 384:nXiFiZcI38NM8TUNTUlIRlQnhxxFgtzTfoB/7yBxVB6P7PoJvVBjKNGQgL/7Iz3r:SFQ33wgahxiUB/703B6TP4ONGmr
TLSH
T1BCC24B35ECA5CDBBECEA4E99A74A7643EEE00063D49C9AD8E5D84D1C00971DE170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7efcfed6-d9a8-4d31-a64f-1fa80ff76ec3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7efcfed6-d9a8-4d31-a64f-1fa80ff76ec3.tmp
Size 32KB
SHA256 ff3683a5fcda8aa403a3473826d03a780caacaf2dfc04e0444b98ab285b85b21
MD5 d5e63154598e1a90d5429760d82a6f76
SHA1 f094e4e0274616b14b3b0940ffa834eeee573d22
SHA512 858de8fe245c07e6a42a8478c5d22edacb7f820e2da24fec0c6b2fa60edee097405e0bfe2e34e0b7b0e7704969404a2f9551d27e64465605a5ae8ccf03a176b3
SSDEEP 384:nliFUQkUSvq8NLL8TUNTUlIRxQnhx4NgtzTfoB/7yBxVB6P7PoJvVBjojNGMT4gA:sFEqQLwgahuiUB/703B6TP4SNGMTDLQ
TLSH
T12BE2A0F5A8E78977E89E4B57A77D2D42A9BCC053B4884A84F7C44D0CCC821BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96423e6b-a634-41fc-946f-872f7e17aa63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96423e6b-a634-41fc-946f-872f7e17aa63.tmp
Size 26KB
SHA256 a74f33d7992f3baab2143dc234351fbf90dc35f33ffd4fcf0a0ce6d7f16136d1
MD5 310f33c8c0997964341db4efb41603f3
SHA1 44cb9a688a72f58e4cee009ae91fc1cbc77cf58d
SHA512 32cca5fef4737e4a556747b2ac391d7c33622f4a2f43419bcf262aeba54d12815707feb0fe80b37dc3b183f89837f6d0c4dc0f3318ba1cf9f61ded7cca0c4f45
SSDEEP 384:zMiFiZcI638NY8TUNTUlIxBQnhxKQttzTfoB/7yBxVB6P7PoJvVBjaNG7O6R2FeI:DFQ63Hwg2hN/UB/703B6TP42NG7TR0qU
TLSH
T1C3C25B35ECA5CDBBECEA8EA9A74A7A06EDF00163D48C9AC4E5D84D1C00975DD170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a35c15db-1a04-4050-b5be-f8c410bde406.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a35c15db-1a04-4050-b5be-f8c410bde406.tmp
Size 105KB
SHA256 9ea13bef147b77cf059af0bbd32c4029231ee71a5eeb87da41465837f995c823
MD5 57517d7e9ca7c7dbf0369b56fc0b7190
SHA1 a15c2c9123a0f7f8e518a208d6f83aaea1923b00
SHA512 b584ef39e653fe4d5ada82f1439bada3ed13f5368752b2c2bfc5418788b2c6d6c615bca5636bbeb2f36bed6c3cf3f63c9dff735604a91156a020790610f0581d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83eeb6fb69147b86d59db93f6bef3b9700e1a01b1e16b7737138a14705b925ec
MD5 1261625a6979743cb430cc1e4a6c87ca
SHA1 3447cdabba89527c05d21de5b837debaa8dddd5d
SHA512 81eea7d5abc59ff723b0b7dcf56140c4ca4b98afc852eb03d6c02eb17e7ee2a4ed4c221a99cd4babf2c7e6721d787537a34f58357037ab616e168d5434558f41
TLSH
T13DD02B80ACD56104C0031437006161103F9894440906E012D0C0027E09C5AD30755062
MD5 SHA1 SHA512 TLSH

Submit Download

8432ef5e-8f59-4d52-a6f8-e86138e12a17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8432ef5e-8f59-4d52-a6f8-e86138e12a17.tmp
Size 414B
SHA256 fba182cd83a6b7ff120045975ba5f936ed141a33353fadd20e8fdca040503c34
MD5 f7b54e83f86355970cbfb3e9234aa352
SHA1 55becfb4773d5aa3ac232f287762658af54620dc
SHA512 ed72052bee0f192697a3d1f6fcefd6353189d930d849e640d7a9fc01158c2444d8c05ce1c4b40c3e6db1d4b6b9189854af2d6daa2b9c1b798f835a6cb14b4db4
TLSH
T1A4E02BA5C971AC2B18FD1B1910510B0AE71403573641554F363D825C8FB4A37568AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

906e5a71-10f6-4d88-84ba-5e91e2ee43c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\906e5a71-10f6-4d88-84ba-5e91e2ee43c5.tmp
Size 12KB
SHA256 03bc75035eb5e0d50dc8b7ad92fea5c0093ed7b4c3e9872a55ac2344b4dd5281
MD5 550004faaf0a2df74a5f08ac1fd3ad87
SHA1 d595a8965fab67ac951a699a32f9afd00eee9485
SHA512 155d529e739ac3678d3bcadaa0cd9e0332d7bd89c61b81678c0b9941b736caee16d1b8bf48db75177f8c52e77fb2f5962e7bd59c7398ca69169cc396ae182cac
SSDEEP 192:sxZpRVFM/fZsiQ705rsf+zodpPE/W6+WNhkj/Y0R14gY+fIgj9J:sxZpBM/fZsi350M/b2/5rY0jH
TLSH
T1E142E8556E74A93F8CDBD609FA55BF53D2F91032A0D11E88A6FC8A1C00EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fcb4219-221c-4118-a76d-b4c1f9973846.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fcb4219-221c-4118-a76d-b4c1f9973846.tmp
Size 28KB
SHA256 104925db88c67e3324a48e6666baa4f383f12061e8d814f625e70f21ca34aed6
MD5 b5c7c91318bec14e6931515e58d504d0
SHA1 3f28ce332078fd4307e871addf39ce09717eddc9
SHA512 26a3ea0903e2b0ae743b9454f31d6b48d565bc7231056c5a68c444f90e515844e8ac85a56965d34a437170a6eb532d7b8247443ffc941d99e4ac3f334904c849
SSDEEP 768:WJ6E28xO215WRmp3Qf/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fsLl/LN0Y3Zroyz:WJ6E28xO215WRmp3Qf/u1jaKfsLpLKYR
TLSH
T164D20B2B740CCB7E4FC05AADDD666F976E9802C7A6688D4047FE894C02C77EA51164CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d9ce4a90f53ea51a8c1610364dde7ef9334147e502ba27ee672c46a3ed5417b5
MD5 73f02f989f094d68c30ed36270f8693b
SHA1 d23d56f26f1c08005463e5ce39bb878b4b32b946
SHA512 55448b8caaf02a29516effdc2fdb006a6b440dfb528937dc54fd3307e6ebc5ee6094a569c421a3a5f5c6f5775a97dc912c610f08c94d04437d9ea899e954b607
TLSH
T1F1E0268904C8C33EA708B79F016E538CDBE0365BA2C2AD1E2701C585720AA50AAC76D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 23KB
SHA256 4571ac8f1a0e5f5ab8eda046d3b53e0c6fb1fd3544b2e690bdb399ff12b5e1af
MD5 fbaa2ad862e3079cdacd2c3b33bef9d1
SHA1 3410a89c48e936ca52e9ff4e3c5f94015d903369
SHA512 babbd30a3fa914bc74136feb8dce6d3342c1f2260e8761ee384fd2515c7adace5d21953f5a13a558e9acb701de5522e8e5636a3fd1f16436699c507eadabe253
SSDEEP 384:kLx8lIIPNP+5F1IZLe/GJeewt7pliwJBBrlMbgf62hxdeulUmA7sXoujNd2Z+:YG9NWlIZSOFwt7WeX5blNUoXoCHR
TLSH
T1DAB2E1C0123C277B72D3DA2D8848048E3A48176EE7B65C2E41B03DA4EBDCBBC7D95559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 36KB
SHA256 a94e765d95ab213d45a6e83017aaff0655074989ca27c8ec214aae1a85d22176
MD5 5c44283ad4483599dd138c33b08fe8c6
SHA1 1a8756dac97b8c1e7aab61ac71f84a9e694da8e4
SHA512 4642756c287502510dcfc034478cb6aaf568c884f9b8838d37f5c5683f27bac5d660949af003b4a9647c93000610f84598d3971396109ad2aa1dccc6555920a4
SSDEEP 768:v8b6ObkOzcBYMnTEOPCKgYPkxM4pNl3yk4UCpAQ7AZMAuGrJn5DVwp3WYD0pkWt:v8bVbkueztP2Me/3yk4UNQcZ7555SARt
TLSH
T1B9F2F12F892CE1CCFE7722F9553189E7FD291D154A5D2AC2C2936C8BE43E2B58484897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 18KB
SHA256 94c79cabaef8b27159fea107ebaf121446f679d9f2aec65e6a2d65abc864729f
MD5 60c66b05ff4f13920ac76f2eab189619
SHA1 0cd97a2b74b39bc09c453bcd03439deeacddd554
SHA512 c44183b6ad1819b9eeaa9766e7d99f58723e87f95245032789515eb4c9ffae92d2d9706824906bccbf1bbf766702a8a130e5ff1d7f49cc53a27d8583c51235dd
SSDEEP 384:7nCRkg0GysoNGKD36OOmFwN6Ib/q2CEeuoHml10XBLKbA:7n1gxysmGKD36OOwIfCTU1ALKbA
TLSH
T13F82D02D35606FC4D2092EBA95963EB90D8FE5B80EE18B4E701F0AF4529E3958809307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 23KB
SHA256 f8c06ad6197bca4efd80b54317febf0903cbc8cd10261767a88dbe0924fc3f32
MD5 393a86d5be7dc039c231d36d88c45b38
SHA1 35b3ac20930fc89cff23a6f21cdf8cbab4d27a5a
SHA512 c32ff8a04fdc8eb178ccd4f41be1fdca30c51b3f309d42f2b2cc4476e634f3b70310543fde1f9a370fd3a45421df524bcc6e628b582f86d75f24b1e239ff38fc
SSDEEP 384:zC7QTcUDUn0a/nq6r4kq6ng6BcGirFvGpsFxCLORocFnmsoyp9F1d8Fq463/1++f:+7hZ0a/n5kkLuGixvqsF/RLnm08SIw8e
TLSH
T11FB2E1092131B3669DFC12D7248D9B7540F5E0DB0269847403C2BAB633EE5B5B2AB6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 49KB
SHA256 42a72e48568f6bff224aa26834b9c95084f1ade94eb76226a416779e1e3d6dd5
MD5 f77aedae1c1d5a16deb965ead68e1ac9
SHA1 7f96e40309947173cff83f79b58961ff4481c61c
SHA512 7e90dc890f8b5422c3f42ba2e3fb904b3bf7e47eb290d4bd44395fbb3568e9823bee4f4a32c624cf5565006451d9875c9bc1fc4fc217145307dec984857ef7ab
SSDEEP 1536:TqGTq7oOJSlPoguMydMZoi7aYhwPSm2Ud:LTGoOAZoguvMBFm22
TLSH
T1B233E1AA71F8C50CECD7403EBDF08943A6E67812CE7E0935E02938969275F95DB043B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 24KB
SHA256 458883ae85fc05fa4e305b6299e8955785a4842872097af4ea5bcba58e740564
MD5 18b163541fb1bfa265949601cd3ec6fe
SHA1 a40941f330f274313e0461f8ba6eca3708dc1308
SHA512 0b5ebc915c19d2b0b0b93fa2ec64181cdc5e85f75fc7e1f7e8dee3f7e1c2a3fed89dc649a259f114278fc96a0041f17bcae03eedd1d1cbf58ca2ad5e55c45a67
SSDEEP 384:gNPmb4cgtdfMts+h4FxySseaTI8LqJZ+4XBpMNqkjI040RXvCdfXIQ6ukWohAfjX:gNmscgXMa+h4XygpNED4tvIcjxJ
TLSH
T151B2E0B08B4D0F1DF0E2C07A90B0299B7B211A5322BCF21D55BBB48B22453594A52FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 74KB
SHA256 dc1389c0ac3e91e01f404d0fc70b530d6a7239cd2cabb3fb2fbe29df037e23bb
MD5 e9ae46a176bf7e8feeedb63ab6347203
SHA1 0ff268e9aeed86164b9118eb2026a64e7505eb24
SHA512 bf81b95f58255aba72f4ec566acaa1bcbe0e22f3f68660ffc458cc1f85b9fc06fc3240b7d701f77303741eb27ed41508a887e5a19a32267b1069ed1110fcd6a1
SSDEEP 1536:aC/QZj7koOvCrro7MKa4DP9Ql39EE+01DWRpH1ti9/E863qE6g7H41c53:aC4VIoVk7USPO3f+mMkCuErbJ53
TLSH
T1007302EE28CDE5A4EE5E33B42D72D548227105B2B279C8859CF121C6D5834EBCE45FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 17KB
SHA256 6ee3874cc7f9d2a83b230608a2dbf8a1a01fcef0b46df95a6ef3ced5313668fb
MD5 b0b98a11c8d076d2be8ae389c58f2b0f
SHA1 2885560bbd27cb05c9db0b5640feb61304cd8636
SHA512 f3649111be4eef59fbfd785b20e0e00a517fcabff7aac145e3534f9f70cc26fa5f3e58a95cfcfd93fdfd80227d45a4f21f051c4bd820326b9c86b108725ed76a
SSDEEP 384:+wTAu1J8CO+ROmSPOwKxeelb2ooD7WrrMJOO3wMyV4nsTfCdTAE2N:vTAgaCDRoPruDbr4gO3ieaKAE6
TLSH
T11282E11317A56129F27457BFE2884E93D72E7290DD73D84BD6857E1172254438E832F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 16KB
SHA256 cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc
MD5 9c6b5ce6b3452e98573e6409c34dd73c
SHA1 de607fadef62e36945a409a838eb8fc36d819b42
SHA512 4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7
SSDEEP 384:XQrDFyKFRXQQ5pGG913BahobGGOal+0HuXpAWBY:grxyUKQ53pdbGg47PY
TLSH
T11D72D0D62F2702F608F294202ECD392C679D7A25F77E6625F0659C860D58EB0D8F4F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 23KB
SHA256 92f9b67622abb5080d414a68029c9c3cc14d96b0f12b00404faca7d9f79660e8
MD5 184203dee9bf3224cfe425410bb4fc88
SHA1 fee9ace359e0fa76fb1a683a6ca61aa6b63cfd62
SHA512 4e6d0083302de4bb552b35842dd650dadf8e216905f84a4a10e0c8f9aa7c474ee0ee9376e9b28f085f6139743c7220574407aa1a1561ee91038a33dd19121533
SSDEEP 384:BMNyTpCHBKYUNpJKInIWvRcFpGoDLdDrUPgcuz5pv1Q4sEopSynIKuF313JkBjRt:ONydC4NpImIWZcnVL6Pg7z//zoYyPoJk
TLSH
T125B2E12B721C8FF0480D2EAFBA2D536C597E41E449C01B65CF83FBAC852C6864A553D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 96c08269e90f16d8ced881e7317e50b1fcaa2eea6bb0cdec3c9a3b672ad2b911
MD5 4cc31c1b7c01b8822cca84b0c9dd303d
SHA1 fdda896c7e318851f0998a9ab9b78b4b0bffbf30
SHA512 090bf94ad0774fbd3a11bd9ffa684f0bc17b418f8ba6b2aa60d834549b21d691a57a44b575ab60af75b41b9b5482556e3297d6b3e917d1f30f1611d98d6e75d1
TLSH
T1C0716F92CB89F00AD7EA1871B5F494BE31359FB632CB1F5601A4E57E7C8A360B1D42D8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 f3ec36c91c7accf991aa0a118e17e091a33673ae60c09adc7bac6c722ad11b63
MD5 6da0994fa6bc85031c7f31b4253f8d47
SHA1 bdf36e7d0fbda1bdb240787bcea4431b2e356727
SHA512 77403a3ba2f55a5804e9f190fa0a507222ec1901fadba81d7a4a54a7fd53204d93a8f7750b0fb9362e7c51b349cddf448a908b81deca57850fd4770ee9cb10fc
SSDEEP 96:ybxb2DTt5YMaK3y0+7p5hHBc1RjM9HMjMWDy7wt:yx2DT3payy0+drBC8M4W1t
TLSH
T1FBA1BA51CA89F51AEBD92A30B4E5487E72389F7572C70F5A05A8F13EBC4B3A075E4284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 191f7a9b26e6ee76302b4c7d7754d26abe54f5321634e91f449b7775c629826c
MD5 38d477786f5328046e7c95f7731bf746
SHA1 c3e496d954c26bd1154e6ec4f1266d020c4418ab
SHA512 cdcf59a111f62ee81c7ca22ad823ea087ebd10148b7cc2d70a15e8aee324ef6241ea451721cd131df2caf86ae4f8b2e689bc40cba7f29f483ad9886e30ea1514
TLSH
T1A6614C85CB89F10AE76808B2B6B490BE3239D7B673CB1F4905A4D56E7C0A350B2C01D8
MD5 SHA1 SHA512 TLSH

Submit Download

bbfa0ce9-cf04-4ecf-ab03-559a761fa43f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bbfa0ce9-cf04-4ecf-ab03-559a761fa43f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0bc40373-23fb-4e42-8aeb-bbc8e0bba47c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0bc40373-23fb-4e42-8aeb-bbc8e0bba47c.tmp
Size 39KB
SHA256 6c24c573b9caa596b64516058beacb6981955ccf1e4ce4ff910073507dc11f98
MD5 f4fb530907c3ef8020fefc3017c13446
SHA1 f5613a340eeecc77c90d5cd3d67cfa889641f6d0
SHA512 557ac16acef84564ee98d0ffee0f22008eee1f91e3b057d86366331dfb6e084525ff9182d38535e748e6b2ed61457fc87b9f689796fca623c6ee035582241863
SSDEEP 384:D1qdZzeHrssiGgBeDgJHkJyywNve1eDDMeFTR5pkKBK3ZcfAHk6jTU9GaaicGAXB:K9yzeAJ0fcjrr7HKdyNGiV
TLSH
T1910387F343E0E57EAA2299F55A15BD16CE5C0929439D3C65CAD4FE0B83E2033E25660F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

322fc0a1-3e8f-41da-88f4-c9c38cccd294.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\322fc0a1-3e8f-41da-88f4-c9c38cccd294.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4fca16d8-1f4a-4177-b8c5-d1b419227bf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4fca16d8-1f4a-4177-b8c5-d1b419227bf3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

5d4f3e8f4c7f58ad_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5d4f3e8f4c7f58ad_0
Size 64KB
SHA256 91cf830687e6ae88cee20d8fde15702019716e3440f5fff2a471959e4a91f622
MD5 d26a1cce7eab020e64ab327226f58ca6
SHA1 4dc4a3b95381a196c1bf81aa8fb32ee8ee1ca85e
SHA512 afd0a5b9365e0ffbaa294422c749ca9e9f590d95c0dd9c915fecd7a3d4d254abee54b16ca5827cb9fdc5edec6ad8e78af6ad7a32b2341bed0da40710f37feba0
SSDEEP 768:35A/wcXAX2TE6WhrJTiJq/QX3hmyVQxO5YDM5XGLFh4MS3pFg8m/za8Mm3BoWMB4:3uQXhviJCQkyVQxHfiFRWhv3i3Bd4
TLSH
T12C534ADA7361B4B3437BA1F1906F130B613AE1A7B404C4E4B194ECE55E54BAA0277FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 ef4e072ae229c04ea5feb3d6ab50c256b82dda2c9c1ccced1467bfb64aa31533
MD5 e825b0f52766de48070f8b91ffb6ea31
SHA1 83eed138b0cd0c856ab2fb0d8ac3cd9b7fca68c9
SHA512 fb42b1577815b254bbb17c0c1c344492f589ed999cb065eaad25c519efaf89d14c9e4a084760d0c62517b7b70029359f765a534af7e22739f2d5c84967a63bca
TLSH
T168A002646B810245C1926EBD50C543603319CDAA06032B034092845A8CE05C24E02E20
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8dee4b7c7e11b189e613dd4f149344b70efa3840c280b70c56d9a31f97ed5e43
MD5 6f15d31476f329c0be1b43ec1c0aa841
SHA1 e43957c34c8ce80bd824293e2942e8e1a2108685
SHA512 3a308e18757a17dfce91a939969fe40a0f103592321c54e1690767518bbcd7ba938c4b32dfa4a3db7b16d2a9a08167b125820ab40a85c4cab16371279170e3d3
SSDEEP 96:KYlWKmcrGr2KosTUwK5e6SmIKT64ygKHK2qOcKjKIrSK4oiOHCKIUzj+fzptB0BL:80Z/jH0TnaJxzh/Mrzcp3wHb00FN
TLSH
T1F3B2231171BA12053CBE290D85B49B2F524232B37119EA3F7FBD50A68E6BE441DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

a13dd772-7ab6-4f8d-86c2-7835a5a335f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a13dd772-7ab6-4f8d-86c2-7835a5a335f9.tmp
Size 12KB
SHA256 d34a8e8b43f42dc9c59d3c62e528a63a629a0562a9c318c6eee594c13fd5ef65
MD5 ac6b67ca461d6b82b6a792bd357d73a5
SHA1 9c008e4f41ab677aaa53344caa6bab82d6ce6d0b
SHA512 1c938824f5b534fa4d36ae3a2eeb0389ba53c0c6bcd2347ad6fdb616b05ac6384896e58121e259042d10cb1c3ae2b0a4d8c46877ad22285460b4993244b03572
SSDEEP 192:sxZpRVoM/fZsoQ7054sf+zodpP//W6+WNh8zXY0Rv+gY+fIg5c9J:sxZp0M/fZso35LX/b6X5rY0KH
TLSH
T1D342E855AE74AA3F8CCBD61DBA55BB53D2FD1032A0C11E88A6FC8A1C01E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddefc306-379b-4ede-924f-83a5d32463fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ddefc306-379b-4ede-924f-83a5d32463fb.tmp
Size 12KB
SHA256 f01fa24b967e6edd4745a72707bbe7de94c0b80700d85c1f34d0616bf600219b
MD5 b2660fa11f662a4e95de326fa4e6fc87
SHA1 9728b402bcbb8f94cc8e3306c8c1011759a11128
SHA512 913edb53a87ab84eed40b75bbd17ab4a8d2a23ea1a74afd8d7494f5dce5edb5b8fdcabc691f58a29900e1364044630b5d1b478813cf4af430e31cc2d306b5cd6
SSDEEP 192:sxZpRVFM/fZsuQ705rsf+zodpPE/W6+WNhkj/Y0R1+gY+fIg5c9J:sxZpBM/fZsu350M/b2/5pY0KH
TLSH
T11F42E855AE74A93F8CDBD609FA55BB53D2FD1032A0C11E88A6FC8A1C01EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd2f8ec9-159c-47d9-a82d-e905036ec461.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd2f8ec9-159c-47d9-a82d-e905036ec461.tmp
Size 12KB
SHA256 1ed7a3751c2d3096d860598488f1839e315c4a80ecec4d54af41ffc735a6899c
MD5 c83814230821053ba39c327c2da1c43d
SHA1 23931dadf8c5e41877edcee78cbb6c4e4f198849
SHA512 90614bf27c13234743dd21f09a282e1cbc2d6f2f7bae81cdd3ec544732467e696a0dbacdd24d17e5dac263f4fca328b5add52cd8ea79cd21e04b7cf344e2419f
SSDEEP 192:sxZpRVFM/fZsoQ705Ssf+zodpP2/W6+WNh8zXY0Rv+gY+fIg5c9J:sxZpBM/fZso35l+/b6X5rY0KH
TLSH
T1B442E855AE74AA3F9CCBD61DBA55BB53D2FD1032A0C11E88A6FC8A1C01E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfe79e2c-f7dc-4443-867c-420a613603ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bfe79e2c-f7dc-4443-867c-420a613603ea.tmp
Size 27KB
SHA256 750e49fabb712514ce554f23a43fd9fbb8d0e3db135c38c4d2b0fa996342f6d7
MD5 d4576a581a0a86d9d47dd6d9060ee80f
SHA1 795d0301b2893637fad9faa0db2b33ca3521b73a
SHA512 3cf63af570b311be232a6a4957683d984750eb6451103d37c55592d0892660f08a7e424867b7d7f88d0b87ce9178a440295ad4c7a1a4ef2c1d34be1569d0d29e
SSDEEP 384:nuiFgQkUSvv8NM8TUNTUlIRxQnhxAFgtzTfoB/7yBxVB6P7PoJvVBjBNGMT4gL/U:FFIv3wgahyiUB/703B6TP41NGMTDLQ
TLSH
T104C24B35ECA5DDB7ADEA4E99A75D3643EEE00163D88C4AD8E6C94D1C00872CD270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1caae884-9061-4c75-b583-417d32a19f3a.tmp

Path C:\Users\Admin\Downloads\1caae884-9061-4c75-b583-417d32a19f3a.tmp
Size 8KB
SHA256 1bb7dde7b5368fea95534008045e78623a4a2b65667958451c8afbcd84ed69d4
MD5 153f3f999507c3446ce03a73d6a6eb79
SHA1 5aa04f8345e31af475782c93afd056d5783a3ead
SHA512 865d52ba7e5792e6437db89dbb70f3beb2539a98aa62cdc1d90f9988432f280ea9710034e774f519316f6c6aa6d0e86165d02f237de2628579b087f5e915cb49
SSDEEP 192:vwttfphrlIDvCrFUbSw7rsVM6tkeNv8+9l/:IttfphiDqrFCTAF8+9h
TLSH
T128F1AE31489C1A84FC6CD6B10EF11A1B8A06E764D431396F2BE80C458E7AADF553A913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OMSI_2_-_Addon_Citybus_O405.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\OMSI_2_-_Addon_Citybus_O405.zip:Zone.Identifier
Size 62B
SHA256 159ddecd9b8ba55814c15eb5f2fceeb3278ad18a0fff251937db3e080871cec9
MD5 db297207027914800c87b1bbe37af6f4
SHA1 38e6b02514ff704cd45a83ac27fdc8d02040d967
SHA512 279c40d7e9c95046d239fcb9f286fd3095d137e2a854a3c56a1630a46c1da33c979ab7c87f860ce5472ff5a8b4560319fd34259faa79ab93dc44a260b99615ed
TLSH
T1FBA022CB0822022C000022B020BFA00CB30BA0000C280280EC2000C3E8800AA80AAA82
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4080-285-0x0000016300000000-0x0000016301000000-memory.dmp

Download