Analysis
- user interaction
yes - max time kernel
295s - max time network
295s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 19:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://workupload.com/file/3YjsfVMKNhx
Resource
win10v2004-20260513-en
General
- Target https://workupload.com/file/3YjsfVMKNhx
- Sample260808-ymemjatejf
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 12 IoCs
resource yara_rule behavioral1/memory/4384-3038-0x0000000000580000-0x00000000011D5000-memory.dmp family_salatstealer behavioral1/memory/4384-3039-0x0000000000580000-0x00000000011D5000-memory.dmp family_salatstealer behavioral1/memory/4384-3043-0x0000000000580000-0x00000000011D5000-memory.dmp family_salatstealer behavioral1/memory/4124-3045-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer behavioral1/memory/4124-3046-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer behavioral1/memory/4124-3047-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer behavioral1/memory/2612-3065-0x0000000000540000-0x0000000001195000-memory.dmp family_salatstealer behavioral1/memory/3164-3072-0x0000000000690000-0x00000000012E5000-memory.dmp family_salatstealer behavioral1/memory/4124-3090-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer behavioral1/memory/4124-3099-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer behavioral1/memory/4124-3100-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer behavioral1/memory/4124-3101-0x0000000000BC0000-0x0000000001815000-memory.dmp family_salatstealer - Downloads MZ/PE file 3 IoCs
flow pid Process 1037 8 msedge.exe 1311 5428 chrome.exe 1838 5428 chrome.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation winrar-x64-713.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 11 IoCs
pid Process 3404 winrar-x64-713.exe 6324 uninstall.exe 6632 processhacker-2.39-setup.exe 724 processhacker-2.39-setup.tmp 5672 ProcessHacker.exe 3808 kprocesshacker.sys 6028 WinRAR.exe 4384 Xeno-v1.3.5.exe 4124 lsass.exe 2612 lsass.exe 3164 lsass.exe - Loads dropped DLL 13 IoCs
pid Process 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 3152 Process not Found - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Probable phishing domain 1 TTPs 1 IoCs
description flow ioc stream HTTP URL 1783 https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a28115ea7fceef52 5 -
resource yara_rule behavioral1/memory/4384-3037-0x0000000000580000-0x00000000011D5000-memory.dmp upx behavioral1/memory/4384-3038-0x0000000000580000-0x00000000011D5000-memory.dmp upx behavioral1/memory/4384-3039-0x0000000000580000-0x00000000011D5000-memory.dmp upx behavioral1/memory/4384-3043-0x0000000000580000-0x00000000011D5000-memory.dmp upx behavioral1/memory/4124-3044-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/memory/4124-3045-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/memory/4124-3046-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/memory/4124-3047-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/files/0x0007000000024712-3048.dat upx behavioral1/memory/2612-3050-0x0000000000540000-0x0000000001195000-memory.dmp upx behavioral1/memory/2612-3065-0x0000000000540000-0x0000000001195000-memory.dmp upx behavioral1/memory/3164-3070-0x0000000000690000-0x00000000012E5000-memory.dmp upx behavioral1/memory/3164-3072-0x0000000000690000-0x00000000012E5000-memory.dmp upx behavioral1/memory/4124-3090-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/memory/4124-3099-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/memory/4124-3100-0x0000000000BC0000-0x0000000001815000-memory.dmp upx behavioral1/memory/4124-3101-0x0000000000BC0000-0x0000000001815000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Process Hacker 2\x86\is-IAS45.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-59HE1.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-T2C6Q.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-EH1SN.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-713.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-713.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-713.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-713.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-713.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-713.exe File opened for modification C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-T83A8.tmp processhacker-2.39-setup.tmp File created C:\Program Files\WinRAR\Descript.ion winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-713.exe File created C:\Program Files\Process Hacker 2\is-8FSN5.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-C0I2A.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-OSVAN.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\unins000.dat processhacker-2.39-setup.tmp File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe Xeno-v1.3.5.exe File opened for modification C:\Program Files\Google\Chrome\Application\lsass.exe lsass.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-713.exe File created C:\Program Files\Process Hacker 2\x86\plugins\is-4LKOB.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-Q30SN.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-122DV.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-65BA3.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-BE0FT.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\WinRAR winrar-x64-713.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-713.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-713.exe File created C:\Program Files\WinRAR\Default32.SFX winrar-x64-713.exe File opened for modification C:\Program Files\Process Hacker 2\plugins\Updater.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\UserNotes.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-A2NQV.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-F26SR.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-713.exe File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-8VVFD.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe lsass.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-713.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-713.exe File opened for modification C:\Program Files\WinRAR\Zip32.SFX winrar-x64-713.exe File created C:\Program Files\Process Hacker 2\is-1C3I2.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-D9VKV.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-0UCFF.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-53FV6.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-713.exe File opened for modification C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\ProcessHacker.exe processhacker-2.39-setup.tmp File created C:\Program Files\WinRAR\Rar.txt winrar-x64-713.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-713.exe File created C:\Program Files\Process Hacker 2\unins000.dat processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-MJUB5.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\85af258b-a365-6d5f-b6b7-1d780ab18ba3 Xeno-v1.3.5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language processhacker-2.39-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language processhacker-2.39-setup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Xeno-v1.3.5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 8 msedge.exe 5428 chrome.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x0008000000024621-2756.dat innosetup behavioral1/memory/6632-2781-0x0000000000400000-0x000000000042B000-memory.dmp innosetup behavioral1/memory/6632-2884-0x0000000000400000-0x000000000042B000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 chrome.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessHacker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ProcessHacker.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306924476976943" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arj uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{75E6CB6F-BE8E-49E6-8C6F-CE43076224C3} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ProcessHacker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ProcessHacker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 ProcessHacker.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 724 processhacker-2.39-setup.tmp 724 processhacker-2.39-setup.tmp 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe 5672 ProcessHacker.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5672 ProcessHacker.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe Token: SeShutdownPrivilege 5732 chrome.exe Token: SeCreatePagefilePrivilege 5732 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe 5732 chrome.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3404 winrar-x64-713.exe 3404 winrar-x64-713.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 3916 1984 msedge.exe 86 PID 1984 wrote to memory of 8 1984 msedge.exe 88 PID 1984 wrote to memory of 4576 1984 msedge.exe 89 PID 1984 wrote to memory of 3736 1984 msedge.exe 90 PID 1984 wrote to memory of 4576 1984 msedge.exe 89 PID 1984 wrote to memory of 4576 1984 msedge.exe 89 PID 1984 wrote to memory of 3736 1984 msedge.exe 90 PID 1984 wrote to memory of 676 1984 msedge.exe 91 PID 1984 wrote to memory of 676 1984 msedge.exe 91 PID 1984 wrote to memory of 676 1984 msedge.exe 91 PID 1984 wrote to memory of 2800 1984 msedge.exe 92 PID 1984 wrote to memory of 2800 1984 msedge.exe 92 PID 1984 wrote to memory of 2800 1984 msedge.exe 92 PID 1984 wrote to memory of 2588 1984 msedge.exe 93 PID 1984 wrote to memory of 3464 1984 msedge.exe 94 PID 1984 wrote to memory of 2588 1984 msedge.exe 93 PID 1984 wrote to memory of 2588 1984 msedge.exe 93 PID 1984 wrote to memory of 3464 1984 msedge.exe 94 PID 1984 wrote to memory of 3464 1984 msedge.exe 94 PID 1984 wrote to memory of 4272 1984 msedge.exe 98 PID 1984 wrote to memory of 4272 1984 msedge.exe 98 PID 1984 wrote to memory of 4016 1984 msedge.exe 99 PID 1984 wrote to memory of 4016 1984 msedge.exe 99 PID 1984 wrote to memory of 3632 1984 msedge.exe 102 PID 1984 wrote to memory of 2344 1984 msedge.exe 103 PID 1984 wrote to memory of 2344 1984 msedge.exe 103 PID 1984 wrote to memory of 2344 1984 msedge.exe 103 PID 1984 wrote to memory of 4948 1984 msedge.exe 104 PID 1984 wrote to memory of 4948 1984 msedge.exe 104 PID 1984 wrote to memory of 4948 1984 msedge.exe 104 PID 1984 wrote to memory of 5044 1984 msedge.exe 105 PID 1984 wrote to memory of 5044 1984 msedge.exe 105 PID 1984 wrote to memory of 5044 1984 msedge.exe 105 PID 1984 wrote to memory of 4396 1984 msedge.exe 106 PID 1984 wrote to memory of 4396 1984 msedge.exe 106 PID 1984 wrote to memory of 4396 1984 msedge.exe 106 PID 1984 wrote to memory of 2832 1984 msedge.exe 107 PID 1984 wrote to memory of 2832 1984 msedge.exe 107 PID 1984 wrote to memory of 2832 1984 msedge.exe 107 PID 1984 wrote to memory of 2920 1984 msedge.exe 109 PID 1984 wrote to memory of 2920 1984 msedge.exe 109 PID 1984 wrote to memory of 2920 1984 msedge.exe 109 PID 1984 wrote to memory of 2612 1984 msedge.exe 110 PID 1984 wrote to memory of 1436 1984 msedge.exe 111 PID 1984 wrote to memory of 2612 1984 msedge.exe 110 PID 1984 wrote to memory of 1436 1984 msedge.exe 111 PID 1984 wrote to memory of 1436 1984 msedge.exe 111 PID 1984 wrote to memory of 812 1984 msedge.exe 112 PID 1984 wrote to memory of 1988 1984 msedge.exe 113 PID 1984 wrote to memory of 1988 1984 msedge.exe 113 PID 1984 wrote to memory of 1988 1984 msedge.exe 113 PID 1984 wrote to memory of 4844 1984 msedge.exe 114 PID 1984 wrote to memory of 4844 1984 msedge.exe 114 PID 1984 wrote to memory of 4844 1984 msedge.exe 114 PID 1984 wrote to memory of 3268 1984 msedge.exe 118 PID 1984 wrote to memory of 3268 1984 msedge.exe 118 PID 1984 wrote to memory of 3268 1984 msedge.exe 118 PID 1984 wrote to memory of 1528 1984 msedge.exe 119 PID 1984 wrote to memory of 1508 1984 msedge.exe 120 PID 1984 wrote to memory of 1764 1984 msedge.exe 121 PID 1984 wrote to memory of 2364 1984 msedge.exe 122 PID 1984 wrote to memory of 2364 1984 msedge.exe 122 PID 1984 wrote to memory of 2364 1984 msedge.exe 122 PID 1984 wrote to memory of 3296 1984 msedge.exe 123
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://workupload.com/file/3YjsfVMKNhx1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a02⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,1205796325140627337,2397741120233049438,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17747529574534886994,4420993777025482155,262144 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,12341031949574364036,13298843961302356984,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,15895081052172276858,8260266071351371294,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1414025251135773727,7938065881556572356,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16079737546587645322,14250254815536669114,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,10193464810967518114,11924053257677425977,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:22⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,12744101437181002061,13022727539590515643,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4378567605582593287,8547829440298819249,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6987208902483626173,955865687798551744,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:82⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6987208902483626173,955865687798551744,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:82⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6212,i,3293886996868102323,12445873503141737335,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,12074970077163417760,9749556627655696062,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:12⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6556,i,4714686282909097093,545482036256392159,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:12⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6668,i,15817817535708410345,11167089189116714918,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6864,i,172131970243902176,3229749841541649618,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4504,i,10370018370229423529,17250706492299726446,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,6810688715940637257,12162530580146678415,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4556,i,14789055514317849681,6726999102899763745,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:12⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15528316015486492785,5359146010538375426,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:82⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6248,i,13387435467586660308,20128499328876126,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7576,i,7294979607760450162,7851375863012904928,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:12⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7572,i,15322687411829186823,5973674478707674416,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,14803325637265541015,6378480730550416197,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:82⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,14864812413536240874,13549891814432580368,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:82⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,18012459737559188367,13580462372497686863,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:82⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6564,i,3525180398428188782,16658839290513432954,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4508,i,9376565731101924061,39114202719277336,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6356,i,5101554493745183781,1789060781534336728,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7116,i,2194653121929235248,15273113809693442616,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:12⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7824,i,4452023829218284874,18357537643470392874,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7972,i,3286461628781605563,16269904869951757716,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:12⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8120,i,198993136019210388,9696479539180465479,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:12⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8272,i,16603418768532759423,14372499557298015851,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:12⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8352,i,10741079014301719870,16890147560002948216,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8328,i,6695307386672195969,6136258672997562628,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8588,i,12252931248845678648,13010650505450498222,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8480,i,17287869040243285692,11817609149426315724,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8904,i,7859644661473218255,11214399160697098895,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:12⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8784,i,6454606735441051187,14203819653891532305,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:12⤵PID:6012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8876,i,5878204263096393949,18428303175194537446,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:12⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8820,i,9102322812746901079,1315302739003180510,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:12⤵PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9048,i,9279305845548165396,15784232530976661249,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:12⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8804,i,18321311039826520995,13392128100713860116,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:12⤵PID:5324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8664,i,4222649687650116807,10952576504985348050,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:12⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8092,i,9508651251979192222,234606382491754433,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:12⤵PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8416,i,11294177954657763781,3588902933157925461,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:12⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8228,i,7989321255708186281,17917005695655307517,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:12⤵PID:5672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7104,i,8735136014828215868,14183263438946771276,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:12⤵PID:5820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8228,i,6135212400827601289,3386831579612656942,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9444,i,12960403990246013042,10836803668235236677,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:12⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9616,i,13152709266681990667,3824171994983943062,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9612 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9780,i,6873989588230072436,3733840694388563604,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9824 /prefetch:12⤵PID:6084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9900,i,7434897557057296277,3429700618275030117,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:12⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10108,i,11278192206052039392,1803080003386525030,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10080 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10280,i,2693842570763510932,8141447374778906795,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10260 /prefetch:12⤵PID:5508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10412,i,16539500948052735375,17725579192210942969,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:12⤵PID:5776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10572,i,11868381099488224270,6539364347936792894,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10548 /prefetch:12⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10684,i,15524890895915164237,3980464989155712333,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:12⤵PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10280,i,562968802083569550,3547714626594173567,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:12⤵PID:6164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=11040,i,894228050918340033,1625501098816943284,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10136 /prefetch:12⤵PID:6256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=11152,i,16024233812162557693,16479839763731112764,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11120 /prefetch:12⤵PID:6356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=11268,i,14128845213026589389,6462796402432925974,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11280 /prefetch:12⤵PID:6364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11428,i,16589922330967073416,10740428209180815046,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:12⤵PID:6372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11560,i,4594869838627550949,9018486766922920603,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11568 /prefetch:12⤵PID:6380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11080,i,16576474423928284431,15668255020377522067,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11808 /prefetch:12⤵PID:6620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=11932,i,4640161884463260248,14649163637804597381,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12052 /prefetch:12⤵PID:6684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=11984,i,4720663131744129621,1544745120263596962,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12192 /prefetch:12⤵PID:6740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11936,i,17855973498131023176,15891205391220386250,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12356 /prefetch:12⤵PID:6848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12404,i,12044320172823863630,10733819176641300164,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12416 /prefetch:12⤵PID:6904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=12272,i,5172013171167853285,16425562327540748137,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12556 /prefetch:12⤵PID:7048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=12560,i,17110851517530646945,2734006501990761643,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12692 /prefetch:12⤵PID:7056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=12344,i,17122410315454052331,13098425397997174436,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12248 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12240,i,6653167241377257109,17210392013370504778,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12336 /prefetch:82⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8460,i,1843597682652617459,3103083284462814601,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=12236,i,9818923248577955517,2109445908822066727,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=12284,i,17068520382545604979,18014167938440869531,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11444 /prefetch:12⤵PID:6840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11560,i,10416467962761296016,8911442587903889301,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11948 /prefetch:12⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=11628,i,3143557375596565926,2918183968149170700,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11604 /prefetch:12⤵PID:6964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10804,i,17203355366416492103,15557366613543235909,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12012 /prefetch:12⤵PID:6976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10132,i,6615532642207851903,15557398787769339386,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:12⤵PID:6992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10160,i,16841926754619770385,17821961238320800564,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:12⤵PID:7012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=12244,i,14084328613054437596,14023393789039885368,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:12⤵PID:7024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=12352,i,16801145438980570016,545444139972333148,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12164 /prefetch:12⤵PID:7044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10288,i,8787351523706418713,2516480393814156492,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:12⤵PID:7120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=8048,i,13682060408058434665,13349806510020773789,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:12⤵PID:7136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=8440,i,2155633258282248861,11536202319693376455,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:12⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=11972,i,13667191529130250730,3427833196229579120,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12972 /prefetch:12⤵PID:5524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=12056,i,8487521324839761210,4512479865038249362,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13124 /prefetch:12⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=13220,i,2358075255573817582,1497938186583502201,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13252 /prefetch:12⤵PID:5584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=13384,i,644809587490208735,9761469494726944330,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13388 /prefetch:12⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=12216,i,12668862291492270530,16913340714934273065,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:12⤵PID:5544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=13620,i,8184685088332391133,8581831548815919164,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13648 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=13692,i,6284497174525342643,12941891899673746418,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12344 /prefetch:12⤵PID:6088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=13892,i,14186892657347382841,9191496138381184904,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13888 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=14032,i,1151213034928688555,6071017787193913931,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=14048 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10924,i,1229416869650317338,12112928888440479906,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11992,i,1104415798654865527,15014727446522049192,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12168 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11704,i,5768288657871138777,4850527620198529813,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12008 /prefetch:12⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11444,i,13907767377218504803,319942612936629057,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13508 /prefetch:12⤵PID:5844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10324,i,13538892053753016280,321447357350270152,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:12⤵PID:5872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=12164,i,10255926426941078401,9870325059956222972,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11584 /prefetch:12⤵PID:5840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=13936,i,2092358421721850048,16468616558885963365,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13872 /prefetch:12⤵PID:5876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=7916,i,13376138221700155982,9874712054523078161,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:12⤵PID:5880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11640,i,7421342824673932665,14483288053198250908,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:12⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10204,i,2123278979428517056,8011894512978060571,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12708 /prefetch:12⤵PID:5684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10132,i,12774184561908970786,8361392439827462070,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:12⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,4314189426319121288,8916892819813874740,524288 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10816 /prefetch:82⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=12780,i,15620250456200373102,6298755144904543668,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12692 /prefetch:12⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=8676,i,818103006739984548,284269798796124321,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=13728 /prefetch:12⤵PID:6740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=9556,i,12325501975029393725,4835290879456529324,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=13264,i,2639017179248516825,2893637707847823470,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:12⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=13260,i,10238697241360998229,16103960596338026534,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:12⤵PID:5680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=11760,i,12434879931517131055,2562849792096156062,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=12836 /prefetch:12⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=12544,i,1305611621005804274,8767837326599245532,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:12⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=2108,i,10672048402500209402,10883688677256004820,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=8896,i,16959977406386067337,17229560142337995370,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:12⤵PID:7056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=11060,i,8556852667811569138,10570951656085282383,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:12⤵PID:5696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=8716,i,6087271358242699478,12606922226849610247,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=7836,i,12564153831979585743,14233061640932161465,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:12⤵PID:5764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=7960,i,10826460545226320420,7639214703033775548,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=10584 /prefetch:12⤵PID:5744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=10568,i,13141970616054398816,11639219365853854002,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=11432 /prefetch:12⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=11540,i,17852653584340244771,16274115395977726340,2097152 --field-trial-handle=2428,i,1014393465541834404,3648177333029155530,262144 --variations-seed-version --mojo-platform-channel-handle=9756 /prefetch:12⤵PID:5824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2764
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffff7cdc728,0x7ffff7cdc734,0x7ffff7cdc7402⤵PID:5860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,8827280864435147752,14633684528302771349,262144 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,55993564451167927,607317242299746608,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1876 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:5428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,12391637076090450851,9317447395206147177,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2484 /prefetch:82⤵PID:5272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,10210255810361484344,4292902122057152608,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:5456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,13200713416662886257,8585840623862026763,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:5476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,15893936796615924818,18234303916797789272,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:5168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,7445647413554028674,17767202417913105232,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:82⤵PID:6064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,3476147309292683060,15895832348350858343,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:6072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,12775827354067506982,8441746709248608536,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:82⤵PID:5636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,14883603001572648071,15322409396880139204,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:6484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,4779748313641966620,2691361785948071224,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:82⤵PID:5400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,9807618706324623037,5399566138217022061,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:5736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3408,i,170067478459107595,14910469673324613365,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:22⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3308,i,820807319658469403,7322497140086038430,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5760,i,14780541848610697274,182132547222323488,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:12⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5776,i,2262360478000909365,17778968447499554564,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3980 /prefetch:12⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,13256750248103460036,3670092953108038211,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5876,i,8639646173085847954,13556702226364184397,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:6072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4628,i,12346245593340866672,6239442188704372751,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:6740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3980,i,2265421424334741997,1995319071889391348,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:82⤵PID:5740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,10312689881424214745,14311603530422019260,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:82⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,10102043591509602590,8766454196192049979,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:82⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6028,i,10409313511442573609,14011301797371480910,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,6262325845076180731,9221591693339407811,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:82⤵PID:5704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4612,i,4070053535218809950,13328194736734154247,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:12⤵PID:6032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6044,i,10688756160463754852,11270785392717996741,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3284,i,532285287589845142,11106783006068328913,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3416,i,4984441705183480007,7677622836436321131,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6208,i,6793478482448322167,18035002461135173982,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:12⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6332,i,18381731783016501638,1550373898237182613,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:12⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6504,i,8464430528510392463,592172881865361093,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6480 /prefetch:12⤵PID:7132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6460,i,16919884072217052752,5636350373599479097,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6672 /prefetch:12⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6692,i,17204105594940821057,11162215623126033574,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6944,i,10891439121864739684,5758943612615819386,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6968 /prefetch:12⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6120,i,5149456252701869869,1560056393421843047,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7200,i,8886544534154331340,1758023985960775731,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7160 /prefetch:12⤵PID:7028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5396,i,7160762427053474244,16911321720300491959,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7300 /prefetch:12⤵PID:6108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7436,i,12436257210474612441,4072044701886944565,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7448 /prefetch:12⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7588,i,18178366710891645670,18083864455523420742,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7600 /prefetch:12⤵PID:5952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7620,i,1421312726656470558,18097627279758459623,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7756 /prefetch:12⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7928,i,9858550535559160156,7597391247706228604,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7956 /prefetch:12⤵PID:6580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8116,i,15517632240934266682,13713695817901837866,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8120 /prefetch:12⤵PID:5508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8252,i,692264939730340435,3274232450888911004,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8240 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8392,i,2622194023617565160,3834551699628262219,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8292 /prefetch:12⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5788,i,16640398212515551548,2808027452203043251,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:12⤵PID:6532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8568,i,5134869871551720507,11047512128315109370,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8672 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7472,i,2692225777010054774,15750004631269850670,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8600 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8392,i,12223787585673790629,16616754662885611644,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8424 /prefetch:12⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5984,i,16068304743249448725,1677517674667979000,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8804 /prefetch:12⤵PID:6212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6788,i,17629200649837745525,14702274498083867819,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:6028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6340,i,9616101779887445305,9776513286109159661,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7284 /prefetch:12⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7300,i,12838782875724164529,14484222673859628500,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7912 /prefetch:12⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7116,i,14578084072815800830,7764477366606586863,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7132 /prefetch:12⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6832,i,15175600855937872226,2479306726719722017,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=3456,i,16295326704456435225,14155290546110096671,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:12⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7692,i,4738259269159485062,17524019668613198612,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7680 /prefetch:12⤵PID:5968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7608,i,15241545597158088046,16517933885892697764,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7408 /prefetch:12⤵PID:6292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6948,i,16835855496448678435,15339434170511135603,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7284 /prefetch:12⤵PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8264,i,14176067490608603736,5610808749413792394,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8904 /prefetch:12⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8320,i,15825306433233351662,7623530546819812147,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7144 /prefetch:12⤵PID:6308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=6152,i,10915058255485092028,16966392169441760445,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:12⤵PID:6496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=6244,i,1777369093193447525,10756411344262326476,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:12⤵PID:6356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=6512,i,5722599766966444905,4890564480504541680,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8864,i,12629582001496295577,15313702350025332166,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8220 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=8716,i,709842954067016505,17435588943171642056,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8748 /prefetch:12⤵PID:6300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8760,i,12723473456470714106,1028216628081499449,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8232 /prefetch:12⤵PID:6348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=7484,i,3115229516996212147,10139306904452561813,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8216 /prefetch:12⤵PID:5728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=6712,i,5317080225194344507,13826880451744301014,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7488 /prefetch:12⤵PID:6884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8148,i,16805167460047838273,3870233384924283015,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8728 /prefetch:12⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=7024,i,6808497649309261278,1248153392390166269,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6700 /prefetch:12⤵PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=7348,i,5993433369269136742,18163956732850879260,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8264 /prefetch:12⤵PID:6268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=6952,i,12451907278576189784,10584235643888650935,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7276 /prefetch:12⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=8428,i,10851438549523516800,16396862530751495453,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7044 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=6128,i,17304353844316465336,17291774637270470601,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7016 /prefetch:12⤵PID:5776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8068,i,5299982460938473383,6014021232861524005,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7620 /prefetch:82⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=8224,i,10631220432029711849,1295506388378573349,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8264 /prefetch:12⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=8388,i,7324241081820028434,10445744968649828784,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6744 /prefetch:12⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=7840,i,3014005447241710594,17194307771308263950,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9100 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=6920,i,337613693473286814,3194570286035821570,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9208 /prefetch:12⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=9248,i,10341617551484553146,10421620335991554606,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9260 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=9396,i,2068572686041787536,2968488429877820850,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9408 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=9560,i,5022330438098114992,8792543147187596824,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9416 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=9780,i,18401883956889965144,12646380711918421877,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9788 /prefetch:12⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=9932,i,8247024686607303710,8201659388432893876,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9936 /prefetch:12⤵PID:5824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=10060,i,5366202538295222754,11180254348352534362,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10064 /prefetch:12⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=10096,i,4430088928053509050,1489413823677734701,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10212 /prefetch:12⤵PID:5804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=10344,i,4292521514079490840,16181883256514908947,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10356 /prefetch:12⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=10504,i,9750994041437020284,5608375469737741035,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10364 /prefetch:12⤵PID:6948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=10544,i,12703503110046780504,1122767057645432145,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10636 /prefetch:12⤵PID:6932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=10768,i,17756826368076599290,7625595270065662612,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10776 /prefetch:12⤵PID:5672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=10072,i,5276308417111598599,9511122415800264002,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9796 /prefetch:12⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=6704,i,3061041145890927035,10799340560895465999,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10948 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=11220,i,125878084445805479,9559262446489295611,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11236 /prefetch:12⤵PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=11280,i,10194068126009756183,12032520210215865266,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11380 /prefetch:12⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --metrics-shmem-handle=11528,i,5426364297949844528,15594515240802122926,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11276 /prefetch:12⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --metrics-shmem-handle=11668,i,816235908966772612,4441432567289346937,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11680 /prefetch:12⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --metrics-shmem-handle=11832,i,14943858595146548972,17395511227210261969,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11700 /prefetch:12⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --metrics-shmem-handle=11808,i,2543259018834426065,18322983553251836406,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12252 /prefetch:12⤵PID:6028
-
-
C:\Users\Admin\Downloads\winrar-x64-713.exe"C:\Users\Admin\Downloads\winrar-x64-713.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3404 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
PID:6324
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --metrics-shmem-handle=10068,i,12968428331962851327,15324174161501703802,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9140 /prefetch:12⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --metrics-shmem-handle=7792,i,14757472489648224485,1951116773933907299,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7180 /prefetch:12⤵PID:6468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --metrics-shmem-handle=7760,i,14989004022706767216,14524185527060192182,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8580 /prefetch:12⤵PID:6212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --metrics-shmem-handle=10556,i,1854977385432019658,9624564526822387406,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7188 /prefetch:12⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --metrics-shmem-handle=10680,i,3112040645017307367,1373513248941834679,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12836 /prefetch:12⤵PID:5628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --metrics-shmem-handle=6324,i,15491280742720572514,6929010628574635805,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6436 /prefetch:12⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --metrics-shmem-handle=9800,i,12130900626011062067,14991407782478659981,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8488 /prefetch:12⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --metrics-shmem-handle=9884,i,2415780154870778231,5780860209681888201,2097152 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10428 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,17016360589784082573,2912628862669819946,524288 --field-trial-handle=1940,i,9514449397924302192,11362207151963706055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8588 /prefetch:82⤵PID:5756
-
-
C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6632 -
C:\Users\Admin\AppData\Local\Temp\is-OJUB2.tmp\processhacker-2.39-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OJUB2.tmp\processhacker-2.39-setup.tmp" /SL5="$D002E,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:724 -
C:\Program Files\Process Hacker 2\ProcessHacker.exe"C:\Program Files\Process Hacker 2\ProcessHacker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5672
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:6392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:6240
-
C:\Program Files\Process Hacker 2\kprocesshacker.sys"C:\Program Files\Process Hacker 2\kprocesshacker.sys"1⤵
- Executes dropped EXE
PID:3808
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Xeno-v1.3.5.rar"1⤵
- Executes dropped EXE
PID:6028
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6404
-
C:\Users\Admin\Desktop\Xeno-v1.3.5\Xeno-v1.3.5.exe"C:\Users\Admin\Desktop\Xeno-v1.3.5\Xeno-v1.3.5.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4384 -
C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe"C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4124 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
PID:6996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe"C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
C:\Program Files\Google\Chrome\Application\lsass.exe"C:\Program Files\Google\Chrome\Application\lsass.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:6296
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
- Size 3.4MB
- SHA256 189caf9893421f12954a3fc7d11aae7ad2e734d64cf9bf83bca7720d4e7d7f06
- MD5 a5edb9f3c3ab5c66a8d8f1603aa009aa
- SHA1 94973b8d319f5abcbae738745b5eb28d0aa46b43
- SHA512 d0b5658403d6ea8f4112294d0c224efe2e8140b7326e8a65d75b1574be93a7fbb836dcb981d43c7566ef792590ea7b582ade27dbc55e1c10ea1fea768eca4698
- SSDEEP 98304:xkBnFMAbX2PH9wsqAvcflrQE4w2EEVodD0w7:knZTSes7KlM9w2EEQD0w
- TLSH T14EF5339884F7CC90E76E20F2E2826D53D0DACFB94897BAFC9A64232717815C7877D425
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
- Size 1.6MB
- SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
- MD5 b365af317ae730a67c936f21432b9c71
- SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
- SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
- TLSH T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 402KB
- SHA256 39baa167de334fef185ae8b97e8c709a307eed08e80fe115577c59a05200a13a
- MD5 7c7fadfc3884853fe0141609fdb1e624
- SHA1 36261b2b3cdbce62b6a9d3139a6c239467a3006a
- SHA512 1d868f5665f6ca182d07bd21ee0e2158cd00062e2633c4845eaf31a242d5868f79f833fd37f87b54f17adc63c7804b95c9d3bcf66c137484f2615992b69ec0d8
- SSDEEP 12288:Kxytky4LvurgzH9C/2qCQW7oIIvS5ejcwU:Kqky4Lvurgz62t5cYwU
- TLSH T1CD949D19E7A455F9E5B7D23CC9924507E6723C51CB71D38F03A10A9A2E237D09E3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 0602bc0996d7499a46ff7ca7d769180f8435f05d795ac23e9ce61e638863a825
- MD5 4b2124b9de7ed8adf8a4d998ce44dcaf
- SHA1 83f3aa8f58d3669130aad5deb4ef04975fa58b5d
- SHA512 542672aed6b5fa5cbf3cd720f7ab8877e8746a8c4e27d6f2b888ab20fb4f0e1c87d96955d259a0db7fdbbc7e4f11799025da52f04bf80b3aa4a1241be678d9d2
- TLSH T176E02BB9CC61EC2B29FE1B1860564745F650139B2641594B7A3C960CCFF0B3A5649C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
- Size 331KB
- SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
- MD5 05ef8155cf66131654d3bb9c9cba5853
- SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
- SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
- SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
- TLSH T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d
- Size 141KB
- SHA256 0f90529d5b432bed668beb149ce46d46efeb6a3e7c4c44436a3af14907479c7c
- MD5 7b114a89fa6da9c729b88d9312ed04c3
- SHA1 e26c48286c03ad8c60c5f7931d406aaab79ce14a
- SHA512 4efaef505ca31d660d70271ffe02f191a7459cdc02517bc560ec5133fbfe26269b571c66f23432728a2e5df93ce91a0604a80365c931bcd7e8e49f8c75355ae7
- SSDEEP 3072:RhP1XeEpXQFMGd/JooK2Xgv8ZAm9i8drXqNThTCASLoAAzY8NmXS:VjMM9mwvKi8lXqWAzYzS
- TLSH T1CAE3129F131F161AF70DBD70CAEBE5993C414F813830E5A613769432479B289EA06AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000065
- Size 199KB
- SHA256 44478573b2ec7a3cc5e6517901c45c803e7cb63a5ccaace6754597e3c17898cf
- MD5 cfefbd56a6c9597164c23cc0290e34a3
- SHA1 78f3f743282f4e22d6c519f96b085410e5ed1289
- SHA512 46a1de44c37d1f042bee01f53db7461dae5b790e074b5cb066e29f52dfa7be7aafc6f08e40fb85fdf9e498c35e2c937729ea4473da406d84971cda99d7985c73
- SSDEEP 6144:lbxO/FLCWc0y9SwZxk8i4ayDwAATyhVBifaNq7Gr:lbxecpNTpH/XGSq7g
- TLSH T1221423103CC6373DD9C83BABAE770723E61E7B6855D1299B20609BA50BC50335996327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a
- Size 34KB
- SHA256 a27936bcbf1b768d2e7d623f808eebd7e03d7571605ed1262b93e2004ac5b0ae
- MD5 1431b48d0ad324ccbafd31bbde2a3517
- SHA1 adfa6eff4e5027afa6af10798ef948d8d1e1d9c6
- SHA512 75efc1a532d9bed68283a95df0f7233ec787951c0438affe4ecdde9ca6f9b71b7fe30aa9730e181cc11f45b7d32a459f9a14d1c81654e32e59db67ab37363f4f
- SSDEEP 768:boiVuYHrigiek7D9pinbZtB4xkSVz0qz5QY0IG2gcbX0SgD6tevLieW:vuCMniXBtSFh5EDJagZc
- TLSH T124F2E159C3F4D86B6853E0C8A661874390D9858438A3A74B70842773FBE387603A5EF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006d
- Size 21KB
- SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
- MD5 484fcc38f9b75715d8be172de22421be
- SHA1 08855b74ef006dc76b4163c833f40451e11a36de
- SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
- SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
- TLSH T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000076
- Size 73KB
- SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
- MD5 86ab42d92e8aaa951eed274da507ad23
- SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
- SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
- SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
- TLSH T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007d
- Size 61KB
- SHA256 bb1d8e7b856d085e64974ae874541ca7f1183d58bd3a6b4c00c7482eb3ec05c7
- MD5 23dd6c3e30c3008b1b6fd7c2f414721c
- SHA1 b1460a21b69a2b25f956be8bbee72e1deb0d0b62
- SHA512 515be667d45a8903b5f85858a2bdfbccccfd25e44497ca13dd7f1cf3fe3e19b3545d339689abc94a5b9fc5277a62f6c8206750cb8c25c020a9ac69793326b979
- SSDEEP 1536:9uxVztJjRCtEmSeGmMGO2h4jkHSeTimnlSfXZOF9z3s2qUi:9ChtJ4Eh7mzP3Tit/ZOc2A
- TLSH T1005302411F7B84C9F084BC0E5631A7FA0360EB98BC9C637F51D4046EB4DB18B349B9A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000080
- Size 23KB
- SHA256 bf7344a487869f902489292361a3b81e27db3a27017de12d9d61e4e682b8f368
- MD5 b675d4db4d4e5a82c9dc0b8612144fbc
- SHA1 66e30db390292b05de524bdef64ba238c0628b1f
- SHA512 28d7dc5d2d62ccb0a057dec4b1dbde364c146d09aac4064844039573d0a39a4de075e6237d51d7be6a71da603495e1da338de061b42bfcc6c1db31bcd3da8263
- SSDEEP 384:2r3H5hXs3U11M8Mpmo2BzDLTeajrLNL3Pda1svboe6PERI+nXG:2NWg1B3Xe+rL93Zzq8RJG
- TLSH T1EFB2F18CA57197CBA796C94160A50E2BFFED0673AE71203145786CAC0BB70C6E1ECA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000081
- Size 158KB
- SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
- MD5 83266658f29f5cb762001d5d9f6985a7
- SHA1 9ff52157193e1e798944e6a3172d938183f5e550
- SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
- SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
- TLSH T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000088
- Size 25KB
- SHA256 a2ed66f01753747ce359a8be0a9555b91e18d01c6bccf8e52a74078520d3720a
- MD5 7077ccb28e70d467500f6994c16ea6b2
- SHA1 b47c8f61db3e92fa3fd0ec2e5021b4ca3586a494
- SHA512 aa84c24767a1aeaea11b48e2b8b4d10a9f668839030fe47d132a425dc5cc30954c7d6106ed1d6d1522d42266ff03c0b7be0f1b95861fba79b6073fc9b992ab62
- SSDEEP 768:3lBWG2FODWjwQU5xhjsNxSyk879qB8RET4qR19ZB:vMFOKUhSxS1L86pPZB
- TLSH T1FCB2E1CAE9CAB097AF1FB05F48E22D256E77B20EF00AC57647A14DD4657E08345E232C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009d
- Size 21KB
- SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
- MD5 2c20035257a126aec473203c38baf276
- SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
- SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
- SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
- TLSH T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009e
- Size 22KB
- SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
- MD5 9e38e04780525a20f28d6c455901b2cf
- SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
- SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
- SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
- TLSH T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009f
- Size 24KB
- SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
- MD5 344ee6eaad74df6b72dec90b1b888aab
- SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
- SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
- SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
- TLSH T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a0
- Size 41KB
- SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
- MD5 a587d1a659231c3c59460569a5564da7
- SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
- SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
- SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
- TLSH T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a1
- Size 24KB
- SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
- MD5 5366c57b20a86f1956780da5e26aac90
- SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
- SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
- SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
- TLSH T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a2
- Size 77KB
- SHA256 12c0cf6bb05c9fd92b8d427d575fcac8880b21a6af0ad600ed1ab2918ac29d94
- MD5 d8cfc5dccc3741f6c68dc8947accb442
- SHA1 a416984ce362f5be78f6c388061719584b9a4850
- SHA512 d7a520fa98026f73e95670766e85d73651378b45ee46b37d9d7eca803f11cc2715881418b3cd5d17bc1e8f4255b729c90b06be657ad8efecc5f6d71a833cbc15
- SSDEEP 1536:NP2s592bW7IJubf1IODz+g6Hp+Aktknk0VBmxL6+4KW2gU/DPgJcQkE/3:N9592YIJujyOw9qxL6+pRgKSctE/3
- TLSH T1447302BA3E76468170628904371F77C16D1A3B749C90EE4990DB3A811C7BDFE025A2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 6KB
- SHA256 79bfbc727ea14a543e0a87cb1d1905da39bb86ca5bdf9111c40ea09bb5c03548
- MD5 ff7bfe1051612d115b92998715b2b7d4
- SHA1 fe34b26f63037077e7f51c15c929f18cca93be56
- SHA512 66a28bb3e96412e3b1d428990efd9326cc54dcfa501127e8f728c662cb39c2cee8aeb3597571ef3c7e42f0e7ab14bf36df1da26101d0b0ac4a93f33ad948b711
- SSDEEP 96:gBvBgy3f+Es3JPnUDv6Hnns6UTmt3VSQ3cbXl6FkT0vx35ieplU78Xwdq2Avks:CawkPnUOnNUKtcQOXl6FaeflUA48vks
- TLSH T17BE1F8F0ACC69139DFC05338C8C50FA9B5395757244B2FC38F698E36A41B7E5861AA27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 45KB
- SHA256 953c16c9cee5a29b05c8c64aa9754c2e13d3aa8e2d9a6158b7268e37d714d564
- MD5 f8de81a76f2073a27cf0f89e50163799
- SHA1 20d7ce3e721361aecdb4703b9a2a6529c9def4ad
- SHA512 0186fdec1fd7ddb4e6895c80fea283f3a7b67753823f0c29751017da3fafa1fa7bc21995ce7d31b3625d272c30e6863a2f60be8f6029d933a5d835ba66c80417
- SSDEEP 384:Dil2bB1TFYRPeaTjOse9SLRJ/N+S/CjJs7EuBeA2gwzWqlelV6mnBedzkgeiFYah:CegRtYotUrdBKic9ZFszy0
- TLSH T18E2388F7C7F4662DCD2262F46A263F1FCD6E09249618386F89D87E1A53E1470E201B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 8KB
- SHA256 890fe9780ee1d5ab2c498e16ec08a9c7dd2139bc51ff03eaa48636c030236393
- MD5 d62c6140a9d38961d4bf37bd44af4001
- SHA1 184175022d6716804e346762cda72c20270f29f4
- SHA512 855f64ee06973fd0cb31ac49f30bf20a9fdce871c497fcfb507f8531f876edba0d81c68b3a135135ec38463d9633eb45556f1b6d7ba3803e3b5cd8b5e6941bac
- SSDEEP 192:7UeU0AUeqUIUBUVsUUUn+UxUeU/Uvo7UKUGUEZUfXU9U7U5U0UsDUyUAUtU8U1Uj:7X9AgxgIsdHk7Mt7zTtqaK6pHZpYlc3I
- TLSH T184128AD7D2FFF42B602A4AAF1F55F905197AA83902826CF8DB56D2BDB0858F30743052
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d5dc4dbe5aa33bafbcd9dcd43d495536e631bb97c12619310155f8e10b034246
- MD5 7a4c483d3ea90f462dfe80e0c4cdc363
- SHA1 59d4bbb69dc12c47165dc694e6855bf0343b2f8d
- SHA512 b5212a8e8fc2b1468f92472412018462769b6a8a25f316f80f3cf01f0b8dc40d18cd41b19c300816f8e9d17995b475b0ffc4def12db436e4ebadb3f727bf44cb
- SSDEEP 192:VRoFUHK8v72vAPRp2+sb1y9THsb+WNn5I27mIL2nX2/eIxsdaYVyIsnAUge:VRoFUqoC6XEZyFw5R6k2X28a8e
- TLSH T10F42B56EAD202A3B5DDAD219FA61775BD7F6003235D42E40EAFC993C25D79CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 b8c3748f984264a5aebf1275887248cb99ff33e290adcaacc3a42546d77478f6
- MD5 325795b8c81f8207eac27db2b845e4d2
- SHA1 5a9b20ff5c8bf3823838642cfadc02ba79e8104e
- SHA512 dd2daaf89a0d52503a5b85f39d3e3878331fadd63ebf115cd65c736e3c5c2d820ecdd3f7b2f84cbd74b3261e5c0e7572e417ae75f700ad2501a4e56dd9e6022e
- SSDEEP 384:VRoFAqoC6Xa0esfnegBqyFwte1kQJ+aOR9k29k2Z28aZE:4FAqHIFwg1kg+LZ2DG
- TLSH T1F662D86FA9202A775DDAD319F921775BE7F6102225C42E80EAFC993C25D7ACC3117407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 15KB
- SHA256 af3f73a1b38e999ac98459bd8c6a148c34a1610c930385ace435bc92b46e782b
- MD5 1be2242108aa0636a3e3c739733b5710
- SHA1 aa45507922bf221ca1632a3c1eb740532c8646a8
- SHA512 220f005cc1f87d80185f45681b78a983a7b03d41e187bec6949d19c04f74886e2fd7ea290346224f82c31a1a7dd58ff1fba1701d43f4b55ce03164f7d49f238f
- SSDEEP 384:VRo5mzAtoCYXc0es0u9oyFwte8kSaOR9k2gWM28azE:45mzAtH0Fwg8kSpM2Dw
- TLSH T1D162D79FA8202A775DEAD319F961B71BE3F5102225D42E94EAFC993C24D76CC3217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 15KB
- SHA256 6f35fb4691c80d72f3f4477ef8984ae51ad92dddb9a1beb5c9fc07dea6e7808e
- MD5 a2e7eb8f6e72ce3ee9d0bf8bdb9b1697
- SHA1 2f8d5f2bf37e827b71143293f3ff8885ec70522d
- SHA512 ac83761bde7d79e5b53d2e584e1d1909320750afd1ede07988c30e63459bbba7383108d2de8787fbf0b222c2b070e57af20cb306e61ee5769a49caa686771827
- SSDEEP 384:VRo5mzBtoCYXc0es0u9KyFwte8kSaOR9k2gWM28azE:45mzBtHqFwg8kSpM2Dw
- TLSH T18162D69BA8202A775DEAD319F961B71BE3F5102225D42E94EAFC993C24D76CC2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 9d2a5f67ee4dd7d7e6e0509731ca30f6273b18bcf43703ee1cb25e179ac98afd
- MD5 be8e5067e92374f6e7a07923a47f705e
- SHA1 6a612312bc577739236d2f02da23bfd7fbe98e76
- SHA512 323e98eb0800ffc112461ad8dbde56e84811b4bd226d01ce1913bd5fbac249aad2845560140d4b14effd814ccee6bcb0fd7f8cab9491f0eca093763756221f8a
- SSDEEP 384:VRoFAGoCYXc0esfnegBqyFwte1kQJ+aOR9k29k2i28azE:4FAGHQFwg1kg+Li2Dw
- TLSH T17962D75BA8202A775DEAD219F921B75BE7F5103125D42E84EAFC993C24E7ACC3117407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 681741442717307b20aa3d911358ca50f071e0ed3ea95fbc753980acef48499d
- MD5 96e07cdaa1fc3172ad1b5715420c841d
- SHA1 76493a7e4bf071c561cee260f669b54d8f1ab8e2
- SHA512 6fed7792d7c60f14672f202d4badf0c6e9edb5a9f8ba1cbc7ac529a295718f8f95fe3993da123f329518f2da2a89be1feb3b241364cfef54a16a19029161a820
- SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3jvHGwIB3WhmHKoUb:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOH9
- TLSH T1A1520967688D963F0FD8C68CDC127F4FADB2019666740C2897FA5C08039A7CB115A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 d4a196cbce99a06536a791dda8553857ce2e779c954b802d3626414aea1b7547
- MD5 3baec425fe986bace1fd1770516c782d
- SHA1 b5f04d472b597d07a9b60b287360e8439e3cdb7d
- SHA512 82a85d2532f73fcef5d8bbabf679a6e96ad4e93dff8592a9333351f096943d76f450801c12cfbe6e3d868b3748cc2b1bc96831c27b1a099d61d68c7014b32ba8
- TLSH T145C01201C02FB861C4C445F15455A8CD32D18F39C041635DA2F857ADBD8B0E101F77A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 144B
- SHA256 095c9cf8f19ccc51a7d69a39ccc0c8e00dd245c786f6296c788150df8ec3183a
- MD5 9f2289ebc97737b25b2e3f0a14c5aa6b
- SHA1 cf81f49332043b626fa2889c450d4bb42e2764d8
- SHA512 17ec351b2f7877b8b7eb7442468fdf9c7fefe35c6e18f4b5a614fc3e973a8a27d9d4fa4f726c2ab3db084b9e91d6de7e3ba8714e59e33a2cf46720d9c45f8d6b
- TLSH T13DC0121919C13D31C5867271AFC64080B7719C104F40414B40E0BB80D5D608B6072338
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 1c101cb3cf04bc01789188fc1817ce6a4506b6574a62c762b32f0e00e23b4912
- MD5 6c6c64abc5e9885e099d576bee06fbeb
- SHA1 ba06b013a88e541029b6af1a557f7bed7a6b1c46
- SHA512 58a9052afb882ccfd91a036a7a84652a3e234ab6ba858b5beac932ec87e06890c28a9bb605c2de45777b3625439ab7dae26589f9ee7b2843160f8031124f4a39
- TLSH T1E1B01262800000B3E5C843F25051145163715E142603130160BD44559D173C4541133C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59df69.TMP
- Size 72B
- SHA256 07bb87eb4e401e1d84f242269c8b1e2284b70e7db5aab18f60471a96d3fe9907
- MD5 3d5758fe7af3e28417508a1132187107
- SHA1 c4d51b5f097adf1431cb7838e06a2c2a23b29830
- SHA512 6674bd8a47d80ab967c62f80019e158f1d43023470d602e2f94a481e7bf525c4cdab9e7ac72acdcd9dfec5137a4acd0f450f2121c47fc8425365d692ebd10b03
- TLSH T1DBA0023496402311C64443B860A383423276CD99BF570A1346910C6A9D59A985551520
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b1847.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 1feca6f2a0dad8806b8d618aa8719e5c68181b3b9b2493225387dc5293a2d257
- MD5 8525f6e9b13715852adbc9277cda4385
- SHA1 e67fbcfb395355ae699cd8ba3f4d16facb955da9
- SHA512 52af629d5261252afb18fd4c960005d13f3db146e1386c56b017172f0600dda914821bff0c2092e8b625bdd8c9199d0d5e6a4a16282a8a25aa830345a296b9e5
- SSDEEP 3072:dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:0m7Rkm1tYpBeh2BAom
- TLSH T198C3123B5E70E97759B9A74EB08E0B1F1EF14AA2C930DA42C8D85A0437F97CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 ae7ef302de4dc1d02d78be1e6441e7467c0a72b6d09acf52d68051826fc0a88f
- MD5 ac0655dd24443d54ff25403fdb37d0b4
- SHA1 db3a5d3329fcbb335bef127e852ec8b7e7949e03
- SHA512 2a9c455c95bd8fccb3b91ac7f966cfcdbae25bafe13d70ba3d0e8e332adb4547c1194965e294911e7b7ddbd6140e8c68f05a7db6b90d42e6e43c20d58909b56b
- SSDEEP 6144:V4hxNPRW2PYddqmY7U52FYm7Rkm1tYpBeh2BAo0:OXPRW4Kq97UAd9oBGcAo0
- TLSH T1693423126DB4AA384C5DFF1D318F2D2E2EF28ED494A4BEC2D8D46F0837AA9841552D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 0aa256d12a8bf598a31cab50d2c2c790c80cd5bcf6c271dc519cf17e6284dca0
- MD5 caf5a4e8281d63337fddc1ed9ca31bbe
- SHA1 0c1ba56f5e8262ad03c346256b69bc455c5e2de6
- SHA512 e028f13a1b6da2de067e3fbbff98a15fda1dcee3ece3e22a9f1b472d631b652dacd280f4e821d4ade65ced875311d693db635929c14d131d0ac711e01f7cc958
- SSDEEP 6144:U5hxNPRW2PYddqmY7U52FYm7Rkm1tYpBeh2BAo0:SXPRW4Kq97UAd9oBGcAo0
- TLSH T1C03423327DB4A9790C69FF0D318F1E2E2EF28EE6D464AEC1C8D45F0437AE9845916834
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 3880063b1f348f20ee1c8537372605c11a8a145282b713293e1793978a5f7515
- MD5 165ab2f013d99a5d11e8af6d639d2a4c
- SHA1 6892618e98dbeb3396344eae79860754a3c2fb52
- SHA512 1e79fd52712052d786116a1354ce323a52cd85ec5c60154734a8caf42be8cee9fba22f4558fc61bd6c60eb463f22883a52506ea0437b445e8f2a072d8b660e65
- SSDEEP 6144:y4hxNPRW2PYddqmY7U52FYm7Rkm1tYpBeh2BAo0:1XPRW4Kq97UAd9oBGcAo0
- TLSH T1CD3423126DB4AA384C5DFF1D318F2D2E2EF28ED494A4BEC2D8D49F0837AAD841552D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 8411aaa83c6882d785c8270f6bdaa8aa5033e74bbf809de5cb4c79f5df5ef25e
- MD5 cf08a6d0087870fc58d0c8db2474eed3
- SHA1 80bdac9cbc572e83204cb08c30b3e915695f51ee
- SHA512 08ae30c63daa466117e3c4503dbfdbc50eb8a992c1aef6381219b3d8e91cba476584998307f4c040bd8ebdbf25d5b0d22c3751caeb57a9ad11455275f8675cdc
- SSDEEP 6144:RrhxNPRW2PYddqmY7U52FYm7Rkm1tYpBeh2BAo0:DXPRW4Kq97UAd9oBGcAo0
- TLSH T1213423327CB5A9790C69FF0D318F1E2E1EF28EE6D468AEC1D8D45F0427AE9845916C34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
- MD5 fd67f6c669d512d4f5409397f5166524
- SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
- SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
- TLSH T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 bb198c81963e699455b64b9ce7875c63551bac1db146ac9e8b16246add4890ae
- MD5 e5b55006b588cbfd0a0c4801b2c1055a
- SHA1 ddde08e8f44660d59ca273351189083ac43d8809
- SHA512 453a760669986555d9c71b4c1e974d6f1c226d7ff4ac867acc428d6346dc81990eb139eda65972c93abd04637b774055ff3725b789c9ae8f2d1492ee6187b2dd
- TLSH T1DCD023707D35EBD6D11E10F45420494112374273315757B5B155584EDEB4081F2DFDF6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
- MD5 722151c3c2c9d1bf9273dad578c24b92
- SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
- SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
- TLSH T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
- MD5 c70fc44a424269679b1300a5be3376a5
- SHA1 6162f1576d71e2726435c2e688415ae394c1369f
- SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
- TLSH T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
- Size 55KB
- SHA256 d248144245f66663244e0ef92127b22bfa7d0db0ff3150f507ecaa68f0585e11
- MD5 dffb2271a40126a8080bc46b818a6fd3
- SHA1 d2eaec38fcaa78807eb27d9f9929f2c1b5a8b33b
- SHA512 5f20ae04317e5d073ec48b363bb37523c03d129244fa03d44a399af3a189dd2b15aa72a3824a2839e5feea9b929a6b6f0a8c178a377f1e1e49bd57dbec316b00
- SSDEEP 1536:omXvDGSsJKBRetkVm7ESQmr1bkWkCr7524hn6f0+4MvT/r:omLGlMIlH2WVr7wen6cevTj
- TLSH T1594302B7F4611F914B88D73FC9F8124B1874D7DE0DCF68B6422E2B6250E70A65C89A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
- Size 77KB
- SHA256 af2d337df29ae7e39f35db57275e79f34a7463629ccaee162ca0cb8fe099a3f4
- MD5 3f98b8ef588222d9f3d880ffae97edd8
- SHA1 7cbcf61ae4f715a287653183bebdfd0175dc503d
- SHA512 aefa8f289b1e2444131f2129a3438b5802fe08eefd2c7165d25f18baf91f9a6462cc920e8f935315717d9191770104efbd1ca246a5aa97f9a6311bfd3145ac5a
- SSDEEP 1536:Kj0NAIf9F7pLXztq2S8G2gBcYfRmc7z/X7J2EQdE/:Kj0NbFlFq23ng2KmGz7Si/
- TLSH T1E873139331DBF67A90B85448D93BEB7C5298DD01A4909EFD004D3E5B45ABC04FD1AE63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
- Size 22KB
- SHA256 8a29164c52109a487957feb42433363ce62bd7b17c7ccec1f0225b7e9bad3c84
- MD5 068c56b4c35d467bbeafff035f15c901
- SHA1 f0e68c98db14d2838adff93e862cff1e680f19f4
- SHA512 aa0af9450f89292b506c00326ee3c4072194ec8cd810b330b4731d3055232cffc0eeeb164d887e39198c60a3238a5a52f032116e1b8253fe38ca6b79f324e3f7
- SSDEEP 384:0huQcxgXVqcsR+C5KTP8KWL/GgssK0pgD9cn3LlpoWROY1vCLkafCfds9tVYsXac:0h4gDsR+C5c7WLugssK0pg5O3DoslJCn
- TLSH T1EBA2F15650923A9F784B2544A1F5303E3F1B94CADDD49013AAF79A20E9F3CB0F65D8C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ce
- Size 47KB
- SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
- MD5 dcf31ebe107435bd68e0164d59e19b87
- SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
- SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
- SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
- TLSH T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d08126aeff01bdd1_0
- Size 269B
- SHA256 c314fcaa4727f54015c8d4df3b23d30eca9762429f1fdb60309b8def48b2c35d
- MD5 d02bbe5ec70d0b2695f264bf06204b2c
- SHA1 ea47b9af2cce13b52f645539c6ed8eda8985beee
- SHA512 d27f65a8a2f3012c1b76bff47765a09b110dab653d3104c8bd16838b822d44fdc542887a2f917c9ea62b41a5ecdc6e92a6b04e2b22cae5b545ee4c0c01c39299
- TLSH T1A4D097F32140B000EA3F87B0B64F454FE90B209C0EAFC2C9920108B22A5B478F9C4BB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 9KB
- SHA256 f875a69838fd6d7182cf9123dea6c07a013424b10d2af75b70ebe0d708a32c14
- MD5 c22ad2bd808ba25cbd01d191964296bc
- SHA1 d7d1ecce673ebe365e8b3b703fa968eb634fd624
- SHA512 3b4f90da6133563908f07ab5f6744522ed0f140fa8d7f7d7d4e14e6ad7e96dd6d670c549d656da095f704774b185d597d27ed8553bf5a5b2f0ba8e84fe9824e3
- SSDEEP 192:6cZwQs8xuf/jsz86H7+UDy6SUXQH1QP7J5x83zfMMXVv:69J5f/jASUDLXLP7J7Qv
- TLSH T18F1281FA38A50412EBEF267150D40D84B9B1F8D7F9172ECE2302EC791956BD6E90781D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 88a7f97717008a3bb37fce4b8f83aaf2fda93fec7899a218679696ada8410310
- MD5 140b81d71b96109806689fa88c747ecf
- SHA1 4b836db3082e2aaf60001c49eadb5558ffee889f
- SHA512 65e866b26ede1ecfdddaa7ab9d9b5e4390f4ccb280ee05a940a0f26ccd85497a99e9e4b66b96afc672b099fa1fcfdd23454f8d782be172547087c89a580a5c8c
- TLSH T10F6180773D3505A2E3AF067094F12AD23035F4DBFA4B2E4E1588B9F51524FE0CE5A808
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 51KB
- SHA256 fbabd3238a782f36f19279a1f3fe4f25a031bc66f90f27635e1b5e6fac1b4765
- MD5 b393e42af69edde3f96f0d417e80c1d3
- SHA1 3cb7e71a8bed81a07b0278296411049c1867e723
- SHA512 2b4624854cedef25452ef7dbae564d3e23ea103dde99efc184dabf10fe194f1468dfe0a5d16de71cc3dd78831470ad7dd4f6e9a95275758c0a5aa43c9fa5bc69
- SSDEEP 768:fDDXPmxFSFsHLOVgAqrjWaZ9v0rdu+sn/zCp:7aZ9cdgn/U
- TLSH T1A1339DF7D3F49A2D8C3151F8AA152E1BCD5A0824A75C3C6BCDE9BF0697F2461D201A4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 211B
- SHA256 e7f233e72109d668be2291da61dfb077010bf998bfdd9bbd1df5456996470c11
- MD5 76a304b454fc543a207e7414dad0a56e
- SHA1 e7b8792de80b5478edeba45e5d1b48fcccff07e2
- SHA512 2557d0024c17488a73f71c77c6db17664132c0d96d32c78d03d5279a5ae1fbcd742b40873fc2f1149ed52d45ad794da47f349c1bb7809efe0b870cf4185cdee8
- TLSH T172D022E317C130B6A66CBEC598AAEC8FC33A00609853EFE811D098E815358AE151F580
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58e9a0.TMP
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 7db50c59c48bbcb7bde694c9df37923cd10f9572aed3ee5d9b61e3b250e2f0af
- MD5 ceab306cf4c9d6efeec08cd0f78d2b96
- SHA1 2e6f6abbaa0b50a7ed1b7c34d7599e688373828d
- SHA512 7c02d010ccf0959ac11a532f4ecd4c383b6a0919b1f083f5a0f55e818c32f876fef26dba4d0c21d3a706d78d035e8e19d4441a5cfcaa3f55c4ea06ee56aadb9c
- SSDEEP 192:sxZgRcyM/jK1Ml8Mkn/fmsYsclIdpIQHW6+WNXwG/Y9IIcAOIgrJ:sxZg6Mn/fmsYsD9HbJ/X9
- TLSH T1BA42E8126A34AA77CCCBD20DF955BF53DAF50472A2940E54A9FCDA1C04E7AEC221781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 82277a0d55c99a7d7ea8109ae5840446d6debad6d6c5143e096b44abc73e071b
- MD5 9dc2e8379665ef4879afcdabda38cf4c
- SHA1 d21b0d1cdb4b707400f97172d58b22ecf11531d7
- SHA512 465755de6e67e0bbe83b429704eb58dd7929f5b46f7422641272f5546dae6da89e93ab192b6130293da082e8cba02611365a135291dc8dc4ac515b893d91c884
- SSDEEP 192:sxZgRcyM/jK1Ml880cB4n/fmsPWpVschlsdp9NFI5HW6+WNXGM4cgvO9Fyq/Y9Ar:sxZg6Wm4n/fmsPWvschqWHba8Z/SINl
- TLSH T10C82F95265349AB7CCDAD60CFE75BF53D6F904229A900E585AFCD91C04EAAFD220381B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 723ec866d1d1b44ad627dc702b107438b1703d7a15c8abbb5da9403b917bfb90
- MD5 d49a37db08f54e12997fc25ecef7bdd5
- SHA1 86c00755599a96edc064eb20bcf1bceb80fc02f5
- SHA512 af32c4728e8d656e5b82fb0431c851b11578b4f7a00f25f13491f7ad1cc69c17419d64a467f1235ade022f663ca4d79f177f2fceac0d59077417f524a7c1224e
- SSDEEP 192:sxZgRcyM/jK1Ml8M0cB4n/fmsZc7sdpTsJ5HW6+WNX8cgvO9/Y9IpIAOIg5aM0Nl:sxZg6sm4n/fmsZcIWHb88/oKNl
- TLSH T18E72F952663499B7CCCAD608F975BF13D6F504329A510E5C6AFCD91C04EAAFD220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 9c46a6599a5cb79d8d41c6908e5e53a4006c2f30cb5cd1d3dbeecfa2537ef855
- MD5 b31eba684699c48835f84ddbbe25599b
- SHA1 4d342671ed3c9ed5d8b1fa9dff44806033df5f2a
- SHA512 6a4730a5ec66652ff26d580dd030786340c6ec8b1e966920c193814640b499c2c68d8979248321578bb67a486c8c6e86654ed9553ebc11077acfa3259698e2b2
- SSDEEP 768:+Tcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNdrorg6z:+Tcv21wWvu+Z+u1jaeFLeRNWrD
- TLSH T1A2D2FA2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\ef4810e7d8aaed39_0
- Size 63KB
- SHA256 5948fa6be02b17330604c67801918c01e1486e8fb924d69f65beaa6399256c1b
- MD5 8d57ac905d469ee6f534a4498eb16a4b
- SHA1 394c46a1394ae269011f97b86186c6c6083d9a24
- SHA512 d949309173fcb45b37e449b5fdd3eb4eebc0b0ae94b6ad95906bf78e9227490ca3007b131fc4441191ed1295b6fd203e2c4c0e4a19a72d234844ce4d9155d3d1
- SSDEEP 1536:28k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:28k3vFpxh4Y473qW
- TLSH T1CA536BA6337178B3427BA1B1906F130B713EE5A7F40484F8A198EDF45E54AA60267F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 1439ffdac104720c7433733b4416b01189ab56153b28cbdce5d74383c03efd59
- MD5 3d13445ffd36a409a61d68ef402bfbed
- SHA1 9365b5b5d57ab8101f4a314706773f2fee55087c
- SHA512 a40168296a37f72d1faa95f1cf1d7ffc51604c274412379980a36dd2a0d4fbaed655ad4fae3ce9625230b073c3394e7e29ecb3d848a09489feec7608e345ef7e
- TLSH T18EA002104E406013D45113B13AEB0A4463144C586345121155E800468CAD7474946213
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 96B
- SHA256 292a29d572a717a14c217267a65c1c044c7559c0fdc9c35047c184f715faa101
- MD5 57e4147840f63bbe994665f6c67b728a
- SHA1 12284e551f253a542e4e500532dcc8dd47a8c3b8
- SHA512 69a27a09603cb17a4ed592426e40618abee025cf33959501273488d99bb24770c60e9438bdab3216b661053c321c6714eb3d4eea18c1c77e4f0b08efb8ca4261
- TLSH T104B022300000A003C00A0BB03AE300003B280F0C03030323E0E8A0CA8C882A3BA0E323
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 892a26d765dc7ecdee02c631921414dab707eea917bb85300b4dc0ea46432be8
- MD5 38456465bc2d33be3c244a72e7985873
- SHA1 15c24121bc6e77ab0b9d62e38364aa36c5785fcc
- SHA512 75c8973608d40f411759396fe288df4e079c4cc728e9506ffe93c92806ca21ddc9110e02f6779dcd2dfb63fd6c442b03c68cbc25db8cac28e544493d9e605cc3
- SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiYC:mT5RXfdX
- TLSH T19AC1DD06307E0342287D695DA6B185378E8176A73858E9BF7BB800A68F67E115CF8CDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592929.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 704efd354413fcb64814bb9670d3f83843fc588e6ac4e55bda13414be66bb409
- MD5 eb8d754781e76ab8262307297ceab602
- SHA1 aac0409ff36f07567f9914c893a243cc977296dd
- SHA512 485fa4f7e787c730cb610fc5e16832cdde4bb0ac2c5ef50b8fbf3288faabda996cfacf6ac54e1b998c4b1ccd10abf21650374d0fe5df9e9b1d1b1c6d5916d388
- SSDEEP 384:KZcIhsNQnpxxziaj9xe+C/dHeWS+2donTKwBODNZOC5KDva:ohTRTpoHkJldonewBKZOi1
- TLSH T1CF927C719C381C775EE2A555F84735078EB89073F6C93B94E5EDBB2C01EA6A8130AC21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 3142e50e85f2a6a947e0162611f7f7896f1f3bb997feb743a375e6fafe6da48d
- MD5 0434433684161a03abd9a160976eeb1a
- SHA1 42a814c5211f8cffc2dd1bd0478137f2817647d4
- SHA512 545ee12efc775a4c90e56d565ff15b7873d5ef8175e2121d06e27ee5df2a4cbfb4b172393b8ab6f397ab9df28c144541c41722702a3b373638c18d4a4e77f7f7
- SSDEEP 768:tFKxPwg4Ri6BHkJlg7LSyu9mbnewBKZOi1:exPu5bnevZr1
- TLSH T183F26CF188D70DB6C5AD9BC7A73EAD025ABCC133B4855918B3E8692DEC5A0BFD301811
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 364a09ce9914e1955667dd7fa76d3299580ceb22dcde78a9cc9171c827d60d95
- MD5 adb07848888de8ab76386edad7e32ee7
- SHA1 c60daefbf2a94572825456be286f7908bdd38066
- SHA512 9390086cc87b7168041b8d172c10f5950e83ff065d111be473b80e0d6047c072a90cb6d70e3c5e4d00235da9f89a44e32edd42d8f5dbe9f56325dae30fb50659
- SSDEEP 192:JONv6v+YLNQmiUyjOZh+CGx+Fdew9ohXus9fU6:JONv6vz/rZh+C/dHe5tU6
- TLSH T1A802FB35AD382CBB9FF26E45F4873A175FA4117BEA962F80D9E81F1C01D765C2306826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 792059aebea8555e118b89c351155f25874e220d5b28f8ccdab8cce0d081eded
- MD5 daba088fa07f331346d3245f330ab051
- SHA1 42c9d7364e1935bba5c9ed83f66931a9d9b257e3
- SHA512 836c9e5f81feb58b6b90dede826a80c1d1cad7ec54892f0d31273baeeba8c211c14e8273fe7e51740a47b0d22c175a29950807e9e65a4c7b1abca60f243fce0b
- SSDEEP 384:TZcIhsNQmpxxziamI62e+C/dHeWS+2donTKwBODNZOC5KDva:LhCRTJ6BHkJldonewBKZOi1
- TLSH T148927C719C381C775EE2A555F84735078EF89077F6C93B94A5EDBB2C01E66A8130AC21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 a9a7e3fba92ad261655828fbcc115c41f5346b67d44104add5cf79144429ee59
- MD5 6c145d55bce9dc3ad28cc34b7f580e5d
- SHA1 275286689a372d73ddcea4d6f2f2cfbbd50afb48
- SHA512 a19e7565eecdcd5a66682b27fd765f6cc47dff495f8d21ea74eef22e24b612ed91d939b9a38efc64f02bf0d0d60ff4d1d8fd4968c90fd5a1ba7b33fc7fcad94a
- SSDEEP 384:GiFiZcID3sNQ8TUNTUlIlmpxxziNGH62e+C/dHeWS+2+onTKwBODNZOC5KDva:tFQ79wg4RSs6BHkJl+onewBKZOi1
- TLSH T1A8D219F248EB4936D9AE5B47E77E2D024EBCC063F5856A50B7D86A1CCC961BFD306810
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 e6e35bd460609ab835bfdeec2e33f3b392be893de1feafa1539faa0951c878aa
- MD5 37cae34e8141ec3e6a4424a20b1247c4
- SHA1 b2c8cf9d0225fe9441e8eac65d243086ca7baa4d
- SHA512 280d939fc10f788163e040464f077dc0d370bebdc92286ba0e36190f9a967f2d7bfade7ca46d50018107e6c315fa2d07ec5cdf616c5a1187733c4f164ffe11c5
- SSDEEP 192:TONZ6v+YLmQmiUyRODh+CGx+Fdew9oh9aFS+2Z5CHFqpU6:TONZ6vzmvDh+C/dHeWS+2coU6
- TLSH T19A121B35AC285C3B5EE36955F48735139FA84167EA8A3F90E5EC2F1C01EF6AC1306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 cfba46f4890d52c58ecee993635a27201fe4b5b965d9ddbba20bcfbb31e30744
- MD5 142516e6d248fa247680eddaadedcfa6
- SHA1 ccae0a112db9b4140b62ef1b5a0d3039bae4588a
- SHA512 26b805c93dbdc21474595705a09fc53d066c720b828a5eea9f8ccd7ce5b7e14b62ed168c7ea6ba8264346d4a1313e381dd0f6c647ec83ea3b18a3eaccc3caaaf
- TLSH T143E00153E34400EEC07C127002876B307AB3C27042E3030A5E3001787C663402F32EC9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 53501f27687e23a3f2a9c6fa7a9334c6cb5042d53ab11749b537f43d42406f58
- MD5 1397a7ff6ee36c4dfe1d76dc58bac001
- SHA1 cf682b911f7f5e627508e5f54eda04883b7594ce
- SHA512 d13bad5088a370f1c757145d5bbc2bb310a822324cad2865f605cae5029ab4aa8ffaa683303ba346a06ddacfe62f1e3f84a98ba5096b432a48881f5e7e15ff3e
- TLSH T1B1E00152E34400EAC07C127002476B306BB2C16042D2030A5A3001687C663001F32DC9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 4d76c4eb69d2617a4751ca7cabb505b4a0c3faad5a6a5a70e2eec01454d03946
- MD5 bb97f743e874be11577b1dcc76e7f920
- SHA1 b7bbdddcb22bda7e2060d36b4308ccd5b44aa502
- SHA512 35841dfee69e988fd087d92cfc2cb6c83fa69e73576242f9fba221536e1ea3177b37d662028ad31210156146d825ab94edc7ed70275ba55cdadd69fea8639f30
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 840b5e3880223b9f185d000d43cdcb44f0eea86e0451906896731293af700548
- MD5 e79a539c9be1a884396c6a2d14ee4967
- SHA1 224aa8b5cc4dab0e7b58f311d1c164a131044b80
- SHA512 f685ea3cec0b06bd81ae95a61bcee3706446b2a63f026a8e2b76be571611fe46273ff86fc0221cddc2989e704a658b2431f9d0e3b5a6bd0fc870f3b014ea9ce7
- TLSH T183E00251D34400DFC074117002472F307BB2C1204352030B5730017C3C763002F124CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c82d.TMP
- Size 392B
- SHA256 fa45dea787e8ef9428a6668cf4bf663bfdd3c06d8bfaf77c8abab048a15e9770
- MD5 a52d052deed318c441162b2b6b7d4fd5
- SHA1 cd8362dae311f452f1b2a0f766b9483bc547acec
- SHA512 864844ae07dc3be0e78549dafdc14e12d8dcc4159f786aeb2b3c3b9f97fa5d21c5b6526167312b7c2a2b74716b68afdc78f4d097d292321415397f4531c49f2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 3b388e1656577a04ee4fca03b6b54f35758e5033f72736d2f93870439b735602
- MD5 6d6666e5d971d83678924885851f4d29
- SHA1 e05cb35bd5310bd9bac27c6f2afedd6525bca327
- SHA512 d8800bae328cff2741c692bbfc5d819cb4a89f40fae72d2f149db7ea2487c9e7536ab57798b9d234fcf7d663ffd6812832c0ceb9681a3a941f06557bd11c2cdf
- SSDEEP 3:MsEllllkEthXllkl2zE/lXJzll:/M/xT02zIll
- TLSH T1934404147FC00407D5C011304055C7511371D450075357C77C510C375CC57C40C00004
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1bd0e7e-0799-487f-8673-a972b727652f.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 5c90ba4df0ebf2ac2dc822800b468b09b97ea4f2102297dc1cf8f3656bb9800c
- MD5 68298efa75307958c16b53bcd253f5d5
- SHA1 b036cc562b4798183bdc32dc4e605c2cfb8a3825
- SHA512 160e2dea67351eb262dcd48673ac398f030648a0a4cdc7e219a8ca215ee7e1fc69bb6601f231b8ff6b803340ea57d5e5488d45439c1b02f4aad536f826c97841
- TLSH T16E412C98AAF91108B3776E5AABF6A87D487BBC772F07D46D00110D4E0763A44C871B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_duhmjrot.f11.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5732_2146214798\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5732_2146214798\a750f061-207b-4e90-93d6-9af19cfe6cb5.tmp
- Size 242KB
- SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
- MD5 541f52e24fe1ef9f8e12377a6ccae0c0
- SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
- SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
- SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
- TLSH T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 396102.crdownload
- Size 2.2MB
- SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
- MD5 54daad58cce5003bee58b28a4f465f49
- SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
- SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
- SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
- TLSH T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 66407.crdownload
- Size 3.6MB
- SHA256 dbc951b4ab01646888b2a91da73a94dd920054c2f27c8cfeacae3eba298e71b0
- MD5 53ef4972d65304468d2519aa692001c8
- SHA1 095036f9669230cb69b42eb5e6d91fdbe46ab61e
- SHA512 3be4a4f1715a06863d552d726549268ae38327023d92b43767c3f71bf34a8f1f46d3d2788218831716016438bedac057068dedf4698cfe6d7ad9024bba49c46a
- SSDEEP 98304:cRZBAYtCkpjsMig0xgsXzQZ5exHkZfqXdl/X+S2H:6RM6S3LXzWexPX/X+R
- TLSH T17C06231DE79418F9E037D238CD934506EAB2BC9D9B71C68F23A515A92F237A09E3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Xeno-v1.3.5.rar.crdownload
- Size 3.4MB
- SHA256 07f36f3c0a68f8e28978018196134edaa735bacb8f1364b2219ceca327defff2
- MD5 14557aae87451ab0348848cdbe715ebf
- SHA1 f8316551d0580ff7a28a7616ba62bbb7df391010
- SHA512 57013446adb78e4061f0fe6a46dd7e85711ae807ebe1d7eaf99cfb3d039984674693019c748048e0d36320d783026bb4427ba8600671af129ed3e6d4b655d50d
- SSDEEP 98304:n/dHs5DtAk6P831cpeDAR+rTQh4O9PBO/8:S5m7831m+AoPQlpOE
- TLSH T168F533C4FFE8A4D4C25429ACDE68BAC4EAF22332C6768E0550D1985E707FC5D9CE29C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\winrar-x64-723.exe.crdownload
- Size 3.6MB
- SHA256 8ff0daf3ed564cc743c0e23ff2e253997ffc74460f9673f0b6dd037b2db4ce7b
- MD5 8f2f0ea48372956b5e817ff11155bf13
- SHA1 3e82a931aba4824e390923369fa300d989f2ebe6
- SHA512 edd9d1f3fdba826f87cf2337ad914e8d3c8faddbf91aa1727ae7c2a4c5e1a202d767658df16f25df6826c8b62a28473b10ff8166a5fda0195210d8e31baac423
- SSDEEP 49152:oWyy3UuXBPUVABbHUeLc8nzOBj3BE43EhR6PIgg3fXIOJjIPiXUDYufHesv1tM9k:0qBAGnaF3BEwOR6gggvXIOCXe/s8HZ
- TLSH T15E06231AEB9414F5E177E134C9634507D6B23C9987B0978F23D9268A2F333A09E3E752
- MD5 SHA1 SHA512 SSDEEP TLSH