Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://workupload.c...

windows10-2004-x64

10

Resubmissions

09/08/2026, 12:09

260809-pbfk1szzgx10

08/08/2026, 19:42

260808-yer8natdlb10

Analysis

  • user interaction
    yes
  • max time kernel
    420s
  • max time network
    422s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 19:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://workupload.com/file/bqYLgqDDH5g
  • Sample260808-yer8natdlb
Score
10/10
credential_accessdefense_evasiondiscoverysalatstealerinstallerpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 32 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 13 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Probable phishing domain 1 TTPs 1 IoCs
  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://workupload.com/file/bqYLgqDDH5g
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
      2⤵
        PID:812
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,13936423721235422602,2249253573333607628,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:4268
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,44075170460733513,6028944881331528612,262144 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
        2⤵
          PID:1812
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1885198292315770204,11425647516696759217,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
          2⤵
            PID:428
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13070710650717325055,62522209066888122,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
            2⤵
              PID:4696
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17444361200996007192,10566270867133340153,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
              2⤵
                PID:3804
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,874069697184019418,9624403482891691652,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
                2⤵
                  PID:3348
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,18371713785115857873,8843320697727237402,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
                  2⤵
                    PID:5012
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,15452010842018631797,14036548794063423949,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:8
                    2⤵
                      PID:4280
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,1343352531038157794,17103020341343190293,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
                      2⤵
                        PID:4104
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3467785481843659489,2948211889358963742,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
                        2⤵
                          PID:2332
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3467785481843659489,2948211889358963742,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
                          2⤵
                            PID:4080
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,13375837250407576569,18300716979690262022,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
                            2⤵
                              PID:1928
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,2723080032732431538,11851198887863448559,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
                              2⤵
                                PID:528
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,15378639415098046100,14165726113683153776,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
                                2⤵
                                  PID:2884
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,7018500674524114849,7887188170600030080,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                                  2⤵
                                    PID:1436
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5352,i,8552644221873144404,4874985272550997934,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
                                    2⤵
                                      PID:2672
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3428,i,16342172641513519846,3324223963352487242,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
                                      2⤵
                                        PID:4148
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,6858007999948158073,9375175169165312391,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
                                        2⤵
                                          PID:952
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5880,i,4611109261801103481,52600365589279899,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
                                          2⤵
                                            PID:1404
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,17708920243336870120,718553296104728141,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
                                            2⤵
                                              PID:3008
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6720,i,3871925673995648811,3754399187883950327,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
                                              2⤵
                                                PID:3332
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,16487664584251193426,417095882951300020,262144 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1928
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,15151523038683575087,17339370372918386999,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
                                                2⤵
                                                  PID:1044
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,5548690543092257940,13314739777416220687,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
                                                  2⤵
                                                    PID:4980
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6880,i,10291709593354810370,16036210550164085404,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
                                                    2⤵
                                                      PID:612
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6656,i,11406613727668123171,7793230301295133555,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                                                      2⤵
                                                        PID:1028
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3680,i,11863315075649925074,18279009007058007248,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
                                                        2⤵
                                                          PID:1264
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5424,i,15474619583936698130,12426784876624550481,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
                                                          2⤵
                                                            PID:3088
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6384,i,1643649213237072540,11435946218397056557,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
                                                            2⤵
                                                              PID:4348
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7028,i,6923177151076448065,5266819475759879525,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
                                                              2⤵
                                                                PID:2004
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,13873026164776690958,5435329710979804601,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
                                                                2⤵
                                                                  PID:548
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7340,i,10794961647018367053,3908516216067741803,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
                                                                  2⤵
                                                                    PID:3576
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7420,i,8152370008976194825,11244847147703271960,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
                                                                    2⤵
                                                                      PID:2484
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7528,i,6988386659716544183,1787383980725882774,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
                                                                      2⤵
                                                                        PID:1456
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7716,i,5694958994281397740,10488168791043443419,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
                                                                        2⤵
                                                                          PID:884
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7844,i,17739261842765628347,5228591929278428569,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
                                                                          2⤵
                                                                            PID:2340
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7976,i,16710314944146944230,12146722859060274436,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
                                                                            2⤵
                                                                              PID:2656
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8132,i,13347021408306834357,17218557512354908689,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
                                                                              2⤵
                                                                                PID:4380
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8268,i,12930968142882743085,12242564643468133547,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:1
                                                                                2⤵
                                                                                  PID:3680
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8328,i,3932967994772900875,13524351071199938187,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
                                                                                  2⤵
                                                                                    PID:612
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8548,i,17659342975574148308,10340373081933505756,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3780
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8700,i,14203527685532918801,12249738602892596101,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3844
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9096,i,14988799495924341066,10323906456207967406,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4680
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9220,i,6246530838902950897,5628742954999205555,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:1
                                                                                          2⤵
                                                                                            PID:2280
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8676,i,8354087293393143749,2257008336933640252,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:1
                                                                                            2⤵
                                                                                              PID:2324
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8660,i,15904731986489300630,7276996827658076570,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5180
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8056,i,7099942466457317302,16645633917711623228,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5200
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8340,i,16237323009861782353,3589604202061740834,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5268
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9532,i,2350739246394058308,3472792096606888235,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=9544 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5316
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9580,i,12719083211369118284,11298901709404906294,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:5332
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9912,i,5230276955426903376,16226143260183012260,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5440
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10088,i,8389309685682731689,3871974922286452233,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:5496
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10224,i,642335060398551766,16930856972317041593,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5552
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10372,i,3034685767956273362,8094244290132301728,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5560
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10556,i,11537610882241484364,385570881603854777,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5664
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10636,i,4109413772535216967,12242710033739228144,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=10648 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:5672
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10860,i,3325884004763861566,4389061483387723908,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=10856 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:5776
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10968,i,9271821648906476896,690657497487346774,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=10988 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:5832
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=11136,i,12559820117038423477,15383067170725164823,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11148 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5840
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=11328,i,11143580271298921464,4947396917330086634,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11320 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5960
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=11424,i,14457485097883917217,12975550643841306645,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11436 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:6016
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10884,i,1963160738012512975,11212338239353463596,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11580 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:6084
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11544,i,2811535494534382148,1122068406482781604,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11684 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:6132
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11824,i,6169378608401376023,3883855759149415123,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11832 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:1064
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12012,i,10477082103293017028,16608368249996142058,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12048 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:6204
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=11672,i,5473709516331105255,16392503504146162918,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12088 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:6272
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=12292,i,9009336446039594928,13257266846125443493,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12304 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:6288
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=12520,i,17705416009542523396,7242453661246275618,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12468 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:6380
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12656,i,11164814755689238724,2961595464605884407,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12660 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:6460
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=11992,i,6457508533785666512,3478995591932246146,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=11952 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:6524
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=13008,i,16389088227542756687,5673158290058721846,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12956 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:6588
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=13024,i,12762738303808576157,3135025921513047347,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13056 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6596
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=13036,i,17955922630007657041,7915047372543907671,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13060 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6604
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13332,i,13533632053651837026,437618446107597684,524288 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13368 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6784
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=12308,i,13981898972027655530,9381729641403149428,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13364 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:6852
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=13580,i,12337385181570248653,17002149921192708285,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13464 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6860
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=13688,i,1564892761758645924,5572142432854109609,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13700 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6868
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=13828,i,17361226761309055209,1500857179137778450,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13832 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6876
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=13864,i,3145342880384897876,11939066691400514869,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13844 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6884
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=13992,i,14606057836870319631,15109503997773549888,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14132 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6892
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=13120,i,4545189574523766976,14028299646992306564,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14252 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6900
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=14312,i,13409036738013789191,4887488559958901015,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14272 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6912
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=14492,i,18017750996290052692,1771536868027731672,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14504 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6920
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=14664,i,16868394343844932928,1125673071553206405,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14508 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6928
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=14900,i,14992209699415816724,7669816277724231494,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14928 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:7320
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=14484,i,5226180062786848316,1931614513950812572,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14800 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:7468
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=15728,i,5406234042862142141,4586466245631826564,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15776 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:7476
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=12976,i,12632289218820940425,11393782931001495545,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15904 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:7484
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=16068,i,16609370186449630763,17668691738291632767,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16076 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:7492
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=16196,i,16647939457312729724,6743556970092270584,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16212 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:7500
                                                                                                                                                                                      • C:\Users\Admin\Downloads\winrar-x64-723.exe
                                                                                                                                                                                        "C:\Users\Admin\Downloads\winrar-x64-723.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:7888
                                                                                                                                                                                        • C:\Program Files\WinRAR\uninstall.exe
                                                                                                                                                                                          "C:\Program Files\WinRAR\uninstall.exe" /setup
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:8904
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=15928,i,5187901288100867168,11690125698335889730,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13224 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:8152
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=15424,i,12236424760138663276,6650347876750330311,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16472 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:8160
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=15416,i,3738942133390654853,1401152299165028050,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16084 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:7840
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=17072,i,9695791168497629397,12317889826709818738,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15336 /prefetch:1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:7728
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=17052,i,9101296032586008495,11699575418728473584,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=17056 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:7844
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=16860,i,15346197401482787922,9264740656230120720,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15332 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:8056
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=15424,i,1563661990315667017,6402301560397057369,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16860 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:8328
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=15484,i,9021417382129458297,17695049088292490436,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15280 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:8336
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=15488,i,1632902273900540003,5290959953646539234,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14344 /prefetch:1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:8344
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=15188,i,16799491674507878482,2935571553891501365,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16032 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:8352
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=15312,i,11177341469095412011,7355641629359772011,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14308 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:8360
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=16256,i,18185150759008852837,6088483821947891090,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15196 /prefetch:1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:8368
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=15308,i,8424072957666426964,2155508875657315981,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15348 /prefetch:1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:8376
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=14988,i,16457821602645475414,10245161444543862766,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16056 /prefetch:1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:8952
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=16288,i,10568821927684639664,7402441765540147843,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16044 /prefetch:1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:8960
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=15140,i,11795139857371358784,6812853808909414137,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15240 /prefetch:1
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:8968
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=15088,i,13778427703374872681,7672558561315465760,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15344 /prefetch:1
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:8976
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=15604,i,14741734013560249034,3921689163976825129,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15572 /prefetch:1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:8984
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=16284,i,4046111797444525619,51191301247264853,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=13884 /prefetch:1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:8992
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=14020,i,6298404438800033633,11810654538761794430,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=12272 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:9000
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=15388,i,13519235570321235376,12386767756322241455,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=14008 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:9008
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=15280,i,9640920888985381659,6970331640888287289,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16052 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:9016
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=15012,i,9056212596895261135,13485999367623606839,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=16048 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5528
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=15052,i,13313786255458045940,9834932955679770463,2097152 --field-trial-handle=2960,i,5706049774502397378,10213647596057912263,262144 --variations-seed-version --mojo-platform-channel-handle=15400 /prefetch:1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                      • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                                                                                                                                                        "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\CatlavanClient (1).rar"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                        PID:6296
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\CatlavanCrack.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\CatlavanCrack.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                        PID:7868
                                                                                                                                                                                                                                        • C:\Program Files (x86)\MSBuild\SppExtComObj.Exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\MSBuild\SppExtComObj.Exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                          PID:2488
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell.exe
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                            PID:7160
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ReAgentc.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\ReAgentc.exe" /disable
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe" -
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5612
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe" -
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                        PID:4276
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb8adec728,0x7ffb8adec734,0x7ffb8adec740
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4884
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,9061713220694422979,12140208070309429275,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:3
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Downloads MZ/PE file
                                                                                                                                                                                                                                            • System Time Discovery
                                                                                                                                                                                                                                            PID:8340
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,12682750377840041914,315351909155607458,262144 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:8364
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,4318367513898395635,8419481116888398369,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:8524
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,10293933395462215017,12328911824223129771,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:8772
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,14832895460728540657,11171747455977880071,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:8780
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,7504523184945094254,3173059736369029328,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3948 /prefetch:2
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:8844
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,15521241741370210897,13874146418886075195,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:7892
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,661078669585060956,6312980660572107809,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:9108
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,18273526868054608926,18183567583556749800,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3428,i,1045203344756332774,10005030652149531030,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:7216
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,3483559226555327129,8484285038023021258,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:6620
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,6075951751443288658,9210251644150266564,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,15356181894301807900,13452902596425184819,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:6988
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,6320466862473987938,8719097767079201679,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:8
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:6540
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,5093938997222923089,7974691248612179650,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:8
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:6548
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4728,i,6088993532004742463,18305583725134835953,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4852 /prefetch:1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:6556
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5788,i,3964805315798179040,5308736158319145075,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:1
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:8292
                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5560,i,15600651653876704939,16058662371617643896,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:9044
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6004,i,10077048770799422206,17402311042578103947,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:1
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5284
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6488,i,6502164138130907269,585164337997866284,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6324,i,12848624046334614588,16335989084820548954,2097152 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,16641465247849247026,10681762918047261656,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4636 /prefetch:8
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5980
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:6380
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-OF3AT.tmp\processhacker-2.39-setup.tmp
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-OF3AT.tmp\processhacker-2.39-setup.tmp" /SL5="$B006E,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5864
                                                                                                                                                                                                                                                                                        • C:\Program Files\Process Hacker 2\ProcessHacker.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                          • Modifies system certificate store
                                                                                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6120,i,6452720991544653888,16721789991566703363,262144 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:8
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:5852
                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,183113529210016560,1704738550356084468,524288 --field-trial-handle=1924,i,6315153465761578374,8819867979278896654,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:8
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:7352
                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:8712
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:8300
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:1648
                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3232
                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:2700
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:7116
                                                                                                                                                                                                                                                                                                • C:\Program Files\Process Hacker 2\kprocesshacker.sys
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Process Hacker 2\kprocesshacker.sys"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows Portable Devices\winlogon.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows Portable Devices\winlogon.exe"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:7560
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Google\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows Defender\explorer.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows Defender\explorer.exe"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\MSBuild\SppExtComObj.Exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\MSBuild\SppExtComObj.Exe"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1256

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                      Phishing

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1566

                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1553

                                                                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1553.004

                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1217

                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                                      System Time Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1124

                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                      ProcessHacker.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Uninstall.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Program Files\WinRAR\Uninstall.exe
                                                                                                                                                                                                                                                                                                      • Size 403KB
                                                                                                                                                                                                                                                                                                      • SHA256 b2c9507de96f47f81a183985c2c1e350ee68fead1da3d91b90e5cfdb2dd46a56
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      BrowsingTopicsState
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                                      • Size 414B
                                                                                                                                                                                                                                                                                                      • SHA256 36353a9549bd87db6e2b1d6f716375ed69538aebf511d14c999590dd550ed630
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000007
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                                                                                                                                                                                                                                                                                      • Size 331KB
                                                                                                                                                                                                                                                                                                      • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_00003d
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
                                                                                                                                                                                                                                                                                                      • Size 76KB
                                                                                                                                                                                                                                                                                                      • SHA256 82c62852a045afab3b03f8f43cbe2c452243f900ef06297aa683e1604d53246c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_00003e
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
                                                                                                                                                                                                                                                                                                      • Size 41KB
                                                                                                                                                                                                                                                                                                      • SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_00003f
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
                                                                                                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                                                                                                      • SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000040
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
                                                                                                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                                                                                                      • SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000041
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041
                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                      • SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000042
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
                                                                                                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                                                                                                      • SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                      • SHA256 649e4ae1df925786e38226d1cb754fbb9792500e3421fded80944100e0785bf7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                                                                                                      • SHA256 a037c06dd52fd41377adb060a585114e839e7bade21a26659fe660a3f5b2b0b4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                                                                      • SHA256 4d1fb01106a410cea30642f1af4d62178e7f450e6070651f3cbb47157aec43a0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                                                                      • SHA256 3d6d6c9d5f7ce1206f4d781af11d84820d6a9f74bf9b6e90b7943221d3ee4b7c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                                                                                                      • SHA256 52e75a5dc757faee941076fa4dc6e8d77fe6ed596eb5974c7b3dfe7732621f4e
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                                                                      • SHA256 c28b1ab666a690f5bee6b84cbd921af8e7b0cef9f600bfc25c68ab08c3bae381
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                                                                      • SHA256 abb7b105dc75b9f6c799910660a85b8dff48d594f72c05e75ac0d33a2e86a9fa
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                                                                                                      • SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 120B
                                                                                                                                                                                                                                                                                                      • SHA256 a503ac13a6b4a728c2b943f43630392b286588b642f2094c66dd06f194dec6b6
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index~RFe5b4998.TMP
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b4998.TMP
                                                                                                                                                                                                                                                                                                      • Size 96B
                                                                                                                                                                                                                                                                                                      • SHA256 b6bb9213d037cc2619e7c73166e3e4fa998da7abbdf1501ba1999b2824c2760c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      c41adb6a-e32b-4add-97da-30988f7e18a4.tmp
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c41adb6a-e32b-4add-97da-30988f7e18a4.tmp
                                                                                                                                                                                                                                                                                                      • Size 6B
                                                                                                                                                                                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 235KB
                                                                                                                                                                                                                                                                                                      • SHA256 4589399a155a3708cfff41777f9f3ccec8c6e83ca9c269ac845e38a8e0164795
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 236KB
                                                                                                                                                                                                                                                                                                      • SHA256 016570c46623d2d89d65aa5ade3b7f46b34ac069544627b31cc9c57380bc8537
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 236KB
                                                                                                                                                                                                                                                                                                      • SHA256 194fb00f4c6ef5912248a5b635a0b777aa0f191b180916a98c1166b9a9d5d3e3
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                                                                      • SHA256 00843aabeed6e3ca6002e82efb24b89fe9a2041bedb42ce50b973a3f4225cef0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 235KB
                                                                                                                                                                                                                                                                                                      • SHA256 51284508404e0ca2144707cd82d53325baad8b90f8f8c742620fa5f2025857ce
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                      • Size 3.4MB
                                                                                                                                                                                                                                                                                                      • SHA256 42766ba58d0f3c61f5b867769d41b0e5181994869067809c93d0a8be22e5ad6f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                      • SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                      • SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                      • SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_0000af
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
                                                                                                                                                                                                                                                                                                      • Size 77KB
                                                                                                                                                                                                                                                                                                      • SHA256 af2d337df29ae7e39f35db57275e79f34a7463629ccaee162ca0cb8fe099a3f4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_0000ce
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ce
                                                                                                                                                                                                                                                                                                      • Size 3.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 8ff0daf3ed564cc743c0e23ff2e253997ffc74460f9673f0b6dd037b2db4ce7b
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                      • SHA256 a99c61c1ca9b28242907fa1f6b099961ad3aa3aa2603f1c8ed2f6ae34a29d217
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                      • SHA256 483f4472a82604112dd5fdfaecd888c64d02b75f61ec88e066dccb8442bfffdd
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                                                                                                      • SHA256 ae951e65cb4c794d075569a06ded5a1292696805bed3a890e62b6612d022080c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index~RFe589a28.TMP
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a28.TMP
                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                      • SHA256 b3165671488ecc7fb5b5253a6c4b76fadc61adf41c7f67692dbdd625749dc969
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Edge Profile.ico
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                      • Size 70KB
                                                                                                                                                                                                                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      CURRENT
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                                                                                                                                                                                      • Size 16B
                                                                                                                                                                                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                                      • SHA256 9ae5794fab4dcbe25f2482fba2b48fe231d2f1182bc8dc299bff17a612b90bf4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                      • SHA256 85fdbcf86be8830174d914d22a2d9ea6169938255b5394070beb27f44cd0b5a6
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                      • Size 111B
                                                                                                                                                                                                                                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                      • Size 211B
                                                                                                                                                                                                                                                                                                      • SHA256 6f889fa907c0d3187944a1897c88872412ffb174d85afe2ebe1d8c85eb83f485
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Sdch Dictionaries~RFe5a831c.TMP
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a831c.TMP
                                                                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                      • SHA256 f0ab44308f54563ee25b2df8985a4b77011805cff7863447c7cc6505dfcfeded
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                      • SHA256 623d07713c127987f502fd7d7b27e7475bf16d58c4987c28c032b60760e61c36
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                      • SHA256 93da081199fc92405061d52006f7fce19ce69f9b8b428cf779bc1698d0950901
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                      • SHA256 facaeca15bac39175d4aa7fb3a34c263d3548eb634c0f8a679b079b6905806b7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 15KB
                                                                                                                                                                                                                                                                                                      • SHA256 b94680d328d2a5b8f36b22348baaf0fc8e795fd5cfb27c4fc9ecc201a654411c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                      • SHA256 d506a3f2909a494e29d8da40d123d0a899d385320b4b79fc773690de745fa56c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                                                                                                      • SHA256 f90884bfab6aa0f3f62155d7a476ed0d57d5670e7f215d91bdc97d9b750e707b
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                                                                                                      • SHA256 10b122e1b7a8271f9bf2329baf656646025dda61d419776948bbd4d01012fc57
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                                                                                                      • SHA256 b6e5f0c3827a39e6e38cb4fc9f232f2bb6e822a65e50bec976d461a157d94388
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      OperationConfig
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      OperationConfig~RFe592f53.TMP
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592f53.TMP
                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                      • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 15KB
                                                                                                                                                                                                                                                                                                      • SHA256 0124be7be775cc2bd712fdf5c448190156785b5a92293766db2282df739b16f7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                                                                                                      • SHA256 ba9aff1654017cee9528a159bb8b1924959f69ed3d6adf83a1ddd5cdfdde0fa5
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                                                                                                                      • SHA256 946f61f50e22360f2fe3414adb7c59aecea12572d8bc363745433157bc4c4b66
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                                                                                                                      • SHA256 081de26c2a4bb790cddaa53eac2752e599b0135eddde4c12033994a55b777590
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                                                                                                      • SHA256 803cc9a20976d42cc3b661b6a0423e5be8358732fa08bdf31dcd810aebe1b26e
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                                                                                                                      • SHA256 52dac173dd4e379f637351706cf296b26a807ac676a13bf483964f43ef91d5bf
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 15KB
                                                                                                                                                                                                                                                                                                      • SHA256 23f57c672a5c2edd0d2a00528f2d1b95bf7fb077c60810513dc1a65a5621dfa5
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                                                                                                      • SHA256 588c58b08b80910c7f67ca93a9faac62d30395e22835aa716f3903bba28168c0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                                                                                                      • SHA256 01eb70bef96b7250e5c7900452c78af0691892745399e5628af0fd40a41b35b6
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      RevisitationBloomfilter~RFe5a46fd.TMP
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a46fd.TMP
                                                                                                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                                                                                                      • SHA256 1599053c337b448cfc8ef0b7b28232c5d56fbc13585651550d2da358ca912be5
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      data_1
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                                                                                                                                                                                                      • Size 264KB
                                                                                                                                                                                                                                                                                                      • SHA256 3c1b5eb5baffaa07e59baca4c42253d16d882c10a4e27d074b8a929e1c270022
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      154a42ab-69df-4d8a-b382-724cb8ec0ff3.tmp
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\154a42ab-69df-4d8a-b382-724cb8ec0ff3.tmp
                                                                                                                                                                                                                                                                                                      • Size 13B
                                                                                                                                                                                                                                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                      • SHA256 7d7554451c661f20f764233b49f2609a42e5d0df3ab19d1baab025a7b0f43273
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      3602942155
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3602942155
                                                                                                                                                                                                                                                                                                      • Size 138KB
                                                                                                                                                                                                                                                                                                      • SHA256 2f4c5f5b00913ec1836bc6555bad2299e7347dc684206ccf251be6fdb278efaa
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      __PSScriptPolicyTest_q1uwg3kv.nf4.ps1
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q1uwg3kv.nf4.ps1
                                                                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      CatlavanClient.rar.crdownload
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Downloads\CatlavanClient.rar.crdownload
                                                                                                                                                                                                                                                                                                      • Size 3.4MB
                                                                                                                                                                                                                                                                                                      • SHA256 9fb0ed8c4d337475e4bfb753efd1ed0237b796fa445740abaf9edf87fff3470e
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Unconfirmed 264318.crdownload
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Downloads\Unconfirmed 264318.crdownload
                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                      • SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      memory/1256-1873-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1373-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1370-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1372-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1374-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1371-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1368-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1364-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1362-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1369-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1648-1363-0x0000019A94160000-0x0000019A94161000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1948-1872-0x0000000000190000-0x0000000000DE6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2420-1870-0x0000000000890000-0x00000000014E6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2420-1871-0x0000000000890000-0x00000000014E6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1867-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1823-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1857-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1856-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1888-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1503-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1855-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1854-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1845-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1844-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1840-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1839-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1858-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1833-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1887-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1164-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1794-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1886-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1884-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1333-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1640-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1885-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1395-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2488-1680-0x0000000000580000-0x00000000011D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4604-1793-0x0000000000010000-0x000000000001B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5356-1491-0x00000000001B0000-0x0000000000E06000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5356-1502-0x00000000001B0000-0x0000000000E06000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5612-1404-0x0000000000C80000-0x00000000018D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5612-1418-0x0000000000C80000-0x00000000018D6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5864-1786-0x0000000000400000-0x00000000004D4000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6380-1672-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6380-1787-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1407-0x00000000058C0000-0x00000000058E2000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1501-0x0000000007B40000-0x0000000007B5A000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1568-0x0000000008DD0000-0x0000000009374000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1566-0x0000000007FE0000-0x0000000008002000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1525-0x0000000007F10000-0x0000000007F18000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1524-0x0000000007FE0000-0x0000000007FFA000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1522-0x0000000007EE0000-0x0000000007EF4000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1521-0x0000000007ED0000-0x0000000007EDE000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1518-0x0000000007EA0000-0x0000000007EB1000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1517-0x0000000007F40000-0x0000000007FD6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1516-0x0000000007E70000-0x0000000007E7A000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1515-0x0000000007D70000-0x0000000007E13000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1514-0x0000000007D50000-0x0000000007D6E000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1505-0x0000000070890000-0x00000000708DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1506-0x0000000070E40000-0x0000000071194000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1504-0x0000000007D10000-0x0000000007D42000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1500-0x00000000081A0000-0x000000000881A000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1405-0x00000000051C0000-0x00000000051F6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1460-0x0000000007AA0000-0x0000000007B16000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1430-0x0000000006D30000-0x0000000006D74000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1420-0x00000000067C0000-0x000000000680C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1406-0x0000000005960000-0x0000000005F88000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1409-0x0000000006130000-0x0000000006196000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1419-0x0000000006780000-0x000000000679E000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1417-0x00000000061A0000-0x00000000064F4000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7160-1408-0x00000000060C0000-0x0000000006126000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7560-1869-0x00000000009C0000-0x0000000001616000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7560-1868-0x00000000009C0000-0x0000000001616000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7868-1129-0x0000000000E60000-0x0000000001AB6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7868-1165-0x0000000000E60000-0x0000000001AB6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7868-1062-0x0000000000E60000-0x0000000001AB6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7868-1063-0x0000000000E60000-0x0000000001AB6000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/7888-888-0x000002BAD9840000-0x000002BADAEB7000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download