hxxps://google[.]com

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
194s
max time network
197s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample260815-y6ermsgk6w

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1052	KMSAuto x64.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
2648	cscript.exe
4768	cscript.exe
4628	cscript.exe
5112	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe
2576	cmd.exe
4768	cmd.exe
6236	cmd.exe
5948	cmd.exe
2136	cmd.exe
1676	cmd.exe
3244	cmd.exe
6180	cmd.exe
6068	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	msedge.exe

Checks SCSI registry key(s) 3 TTPs 13 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312990351717704"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{9CDBE3E0-819B-4BF4-ACEB-C575E118A1C4}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\KMSAuto++ Portable v1.9.9 b09.7z:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
6824	msedge.exe
6824	msedge.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe
7336	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2648	7zG.exe
Token: 35	2648	7zG.exe
Token: SeSecurityPrivilege	2648	7zG.exe
Token: SeSecurityPrivilege	2648	7zG.exe
Token: SeDebugPrivilege	6496	taskmgr.exe
Token: SeSystemProfilePrivilege	6496	taskmgr.exe
Token: SeCreateGlobalPrivilege	6496	taskmgr.exe
Token: SeDebugPrivilege	6588	taskmgr.exe
Token: SeSystemProfilePrivilege	6588	taskmgr.exe
Token: SeCreateGlobalPrivilege	6588	taskmgr.exe
Token: 33	6588	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6588	taskmgr.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe
Token: 33	5348	mmc.exe
Token: SeIncBasePriorityPrivilege	5348	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
2648	7zG.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
1052	KMSAuto x64.exe
1052	KMSAuto x64.exe
1052	KMSAuto x64.exe
1052	KMSAuto x64.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6496	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe
6588	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1052	KMSAuto x64.exe
5348	mmc.exe
5348	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4964	4616	msedge.exe	79
PID 4616 wrote to memory of 1852	4616	msedge.exe	80
PID 4616 wrote to memory of 5600	4616	msedge.exe	81
PID 4616 wrote to memory of 5600	4616	msedge.exe	81
PID 4616 wrote to memory of 5600	4616	msedge.exe	81
PID 4616 wrote to memory of 792	4616	msedge.exe	82
PID 4616 wrote to memory of 792	4616	msedge.exe	82
PID 4616 wrote to memory of 3640	4616	msedge.exe	84
PID 4616 wrote to memory of 6080	4616	msedge.exe	85
PID 4616 wrote to memory of 3640	4616	msedge.exe	84
PID 4616 wrote to memory of 3640	4616	msedge.exe	84
PID 4616 wrote to memory of 6080	4616	msedge.exe	85
PID 4616 wrote to memory of 6080	4616	msedge.exe	85
PID 4616 wrote to memory of 4272	4616	msedge.exe	87
PID 4616 wrote to memory of 4272	4616	msedge.exe	87
PID 4616 wrote to memory of 4272	4616	msedge.exe	87
PID 4616 wrote to memory of 3796	4616	msedge.exe	88
PID 4616 wrote to memory of 3796	4616	msedge.exe	88
PID 4616 wrote to memory of 5348	4616	msedge.exe	89
PID 4616 wrote to memory of 5348	4616	msedge.exe	89
PID 4616 wrote to memory of 4356	4616	msedge.exe	90
PID 4616 wrote to memory of 5256	4616	msedge.exe	92
PID 4356 wrote to memory of 5280	4356	msedge.exe	93
PID 4616 wrote to memory of 4892	4616	msedge.exe	96
PID 4616 wrote to memory of 4892	4616	msedge.exe	96
PID 4616 wrote to memory of 4892	4616	msedge.exe	96
PID 4616 wrote to memory of 4864	4616	msedge.exe	97
PID 4616 wrote to memory of 4864	4616	msedge.exe	97
PID 4616 wrote to memory of 4864	4616	msedge.exe	97
PID 4616 wrote to memory of 2864	4616	msedge.exe	98
PID 4616 wrote to memory of 2864	4616	msedge.exe	98
PID 4616 wrote to memory of 2864	4616	msedge.exe	98
PID 4616 wrote to memory of 4596	4616	msedge.exe	99
PID 4616 wrote to memory of 1452	4616	msedge.exe	100
PID 4616 wrote to memory of 1960	4616	msedge.exe	101
PID 4616 wrote to memory of 5896	4616	msedge.exe	102
PID 4616 wrote to memory of 5896	4616	msedge.exe	102
PID 4616 wrote to memory of 5896	4616	msedge.exe	102
PID 4616 wrote to memory of 940	4616	msedge.exe	103
PID 4616 wrote to memory of 940	4616	msedge.exe	103
PID 4616 wrote to memory of 5640	4616	msedge.exe	104
PID 4616 wrote to memory of 5640	4616	msedge.exe	104
PID 4616 wrote to memory of 5640	4616	msedge.exe	104
PID 4616 wrote to memory of 2232	4616	msedge.exe	105
PID 4616 wrote to memory of 2232	4616	msedge.exe	105
PID 4616 wrote to memory of 2232	4616	msedge.exe	105
PID 4616 wrote to memory of 2012	4616	msedge.exe	106
PID 4616 wrote to memory of 2012	4616	msedge.exe	106
PID 4616 wrote to memory of 2012	4616	msedge.exe	106
PID 4616 wrote to memory of 4316	4616	msedge.exe	107
PID 4616 wrote to memory of 4316	4616	msedge.exe	107
PID 4616 wrote to memory of 4316	4616	msedge.exe	107
PID 4616 wrote to memory of 5260	4616	msedge.exe	108
PID 4616 wrote to memory of 5260	4616	msedge.exe	108
PID 4616 wrote to memory of 5260	4616	msedge.exe	108
PID 4616 wrote to memory of 4868	4616	msedge.exe	109
PID 4616 wrote to memory of 4868	4616	msedge.exe	109
PID 4616 wrote to memory of 4868	4616	msedge.exe	109
PID 4616 wrote to memory of 1400	4616	msedge.exe	110
PID 4616 wrote to memory of 1400	4616	msedge.exe	110
PID 4616 wrote to memory of 1400	4616	msedge.exe	110
PID 4616 wrote to memory of 1124	4616	msedge.exe	111
PID 4616 wrote to memory of 1124	4616	msedge.exe	111
PID 4616 wrote to memory of 1124	4616	msedge.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1648,i,5041919014815161828,12455652269543768453,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,9725223992802673906,4792649354178025891,262144 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,12348907846997867034,8150723177011421728,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9161322385613817373,4290957768866626634,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,1723526656423542989,11161760980432622189,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,5876938228966876922,13104311490049530970,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,1529381920796676335,13136493171866352876,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,16139400231858022385,7914794204128839956,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,15883877489705860239,661278564972724438,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18324383705591943148,8260189119876052448,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18324383705591943148,8260189119876052448,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6312,i,9924484936209419338,13319575500705160369,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6324,i,13996095287005513093,9179443509365496166,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6548,i,1908039569237984576,6953022354493787361,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,16183719756337785157,10868988975779704126,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1552,i,7356589663025330167,3474001894188497960,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,7679042077846184602,6315149685642191534,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4908,i,9438373209751114573,17517042482958451197,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,15126776722667986422,8032020071212236147,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=1764,i,3893367737730330159,12921019452017182691,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3564,i,7293975774248302685,16301536073912183645,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6152,i,4698959881863299901,8879727782680470556,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5944,i,11227440042994154267,17333722809520369982,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=1764,i,10498162752074865609,7880045863346526007,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7308,i,9306290196624307785,1828906866836507068,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7488,i,9451513680537596775,14991416149759811690,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7636,i,5239337171277112389,14789939420071697967,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7784,i,393696537412945016,10602314643087161327,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7844,i,6231159424283325505,6408548229403019430,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8124,i,13538528010459573381,6916313687964383691,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8268,i,12424704992021740426,9563129164059396326,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8416,i,14494083988836731537,4774065166718905164,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7468,i,9538114823586633228,13281797718176261653,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8908,i,15440319307023019990,14289933514717423909,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9080,i,4356235988807669291,15393602341060404212,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9204,i,18337605320960921439,4184350713328571232,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9232,i,4547863178676619140,8290872235487634198,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9404 /prefetch:1
  2⤵
  PID:272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9444,i,3628453147394897452,8339657037483091224,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9464,i,984320765947076462,13275289076785182639,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9480,i,7184708354799772427,17917024693229287810,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9584 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9204,i,290796293326455758,11010862033166836604,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9508,i,7123176623544068939,14439512218789536661,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9672 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9520,i,13035035632079417476,6041044836422280374,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9568,i,14983313838370445395,5448248804168210081,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9696 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9440,i,2372955043732315703,18264582654591679244,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9808,i,4908016786770972424,16240240623114338471,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9196,i,3820927354257648032,5616123831538489533,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10888 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10880,i,17010976947725879783,13716902281385934505,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10876 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9516,i,17292854813373406553,12088291046322801623,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11256,i,12228935922766210094,3636455027062585465,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10884 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11416,i,9867028148601977617,15379489477433009750,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11564,i,10291094205177893142,1788025934452573310,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=11532 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11732,i,1753757310367191547,4548948665629573602,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=11544 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=11836,i,7235393349326833397,12018310208326945505,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=11864 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=11996,i,4110940962968439050,14944849918039582416,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12012 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12148,i,4478880152707966024,14425269675814840901,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12196 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12016,i,3881309061618170807,853892606262289991,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12344 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7212,i,6037755361397655908,2892190599953163812,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9500 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9672,i,12906836436301436764,16859185460133933318,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9728,i,11064119557046371773,14079588398523200889,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6996,i,8243469590074505053,2562569992090491626,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7072,i,7551759895847252198,8863446232245616572,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=12608,i,11002805828118965225,13633478320996995995,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12624 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8580,i,5810355437366159600,982129871683843773,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12820 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=12880,i,17704620280452115877,3846352089823413050,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12888 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=13080,i,4485833771972831563,11307441783607363254,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13084 /prefetch:1
  2⤵
  PID:6184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=13224,i,2547838958359587771,6157602921614941856,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13184 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=13336,i,13084227858422790552,9810640532619395342,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13352 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=13216,i,10641022897286842207,15199342707940864523,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12872 /prefetch:1
  2⤵
  PID:6356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=13028,i,5537277139425879700,13426611273577069835,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13476 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=13640,i,217584546935038033,2742288750756791092,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13656 /prefetch:1
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=13800,i,14893869836148727764,11584318948364336719,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13780 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=12828,i,6837239271498708671,16882707631327824143,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13336 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=13924,i,8470310211244218979,13119075081436216306,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13988 /prefetch:1
  2⤵
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14244,i,8503617091006416288,6477172518642697959,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14252 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=14476,i,1798312861137486117,5567150537867283251,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14500 /prefetch:1
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=14564,i,4768686336768420095,10059559710221578623,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14576 /prefetch:1
  2⤵
  PID:6760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=14592,i,15328275308144256474,10630652074192916808,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14724 /prefetch:1
  2⤵
  PID:6816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=13788,i,13691102326621107859,897397231827418161,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14740 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13240,i,10027588917945730247,17175396809704409696,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13488 /prefetch:14
  2⤵
  PID:7140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=12296,i,4726952151917815414,8216926585096152002,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12280 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=13788,i,11765864796548663817,16951079902969900209,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14864 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10444,i,10202892620968372021,4339666026940415553,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=5808,i,17804393393398104107,532881788679068005,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14396 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=14448,i,2890638355053618041,16575746902671331635,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10944,i,5644547475261328904,11192210470202612819,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10996 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=14712,i,7174180187150200439,13924726841496104703,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13556 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=6652,i,14674459460614728236,13066359832709400368,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=8320,i,5380120013417936327,14077383736803571113,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14420 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9472,i,6303180070935060858,13476350258946771043,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13856 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=14404,i,9301474050224948079,10608847587137542313,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10836 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=12648,i,17356325865001106862,9498171675566791074,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12716 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=12720,i,5730837935781498723,10975862799806937002,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10024,i,16708518549309228387,8349707753063024939,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=13376,i,18072775490688256470,6457593805998420920,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10968 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=14968,i,11685907347526714740,14274679264670325208,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14912 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=13292,i,1958599077743915284,6465649984141180900,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=12652 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=9892,i,2898382701774031619,16460687454257434116,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=14972 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=13360,i,10299374010287123928,13000356138707287133,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13176 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9124,i,9908232492996980830,18415897400363015897,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13428 /prefetch:14
  2⤵
  - NTFS ADS
  PID:6256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10720,i,13539623075917052254,15426386945300134759,2097152 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10484 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,5013286771016990670,11851248289437604644,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=13060 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=14916,i,12194241955403867309,4351153300005328747,262144 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=10800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3252,i,5929590792990912401,6238198018465880751,524288 --field-trial-handle=2164,i,10017520266475023312,16966844284943857345,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:7196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6620

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2144

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap12778:114:7zEvent4877
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2648

C:\Users\Admin\Desktop\KMSAuto++ Portable v1.9.9 b09\KMSAuto x64.exe
"C:\Users\Admin\Desktop\KMSAuto++ Portable v1.9.9 b09\KMSAuto x64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  - Executes a command shell one-liner
  PID:6236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /dlv all
  2⤵
  - Executes a command shell one-liner
  PID:4820
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /dlv all
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
  2⤵
  - Executes a command shell one-liner
  PID:5948
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d kms.loli.best /t REG_SZ /reg:32
  2⤵
  - Executes a command shell one-liner
  PID:2136
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d kms.loli.best /t REG_SZ /reg:32
    3⤵
    PID:6640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:32
  2⤵
  - Executes a command shell one-liner
  PID:1676
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:32
    3⤵
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d kms.loli.best /t REG_SZ /reg:64
  2⤵
  - Executes a command shell one-liner
  PID:3244
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d kms.loli.best /t REG_SZ /reg:64
    3⤵
    PID:832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:64
  2⤵
  - Executes a command shell one-liner
  PID:6180
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:64
    3⤵
    PID:3460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /skms kms.loli.best:1688
  2⤵
  - Executes a command shell one-liner
  PID:6068
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /skms kms.loli.best:1688
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ato
  2⤵
  - Executes a command shell one-liner
  PID:2576
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ato
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4768

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6496

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:6588

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5348

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:7336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ff6fff5f1357d6577b7f6c23126ef11ee58b55b642f8201a6c8d78dd6b4c8570
MD5 16afa2d1ad3ac4763aee200c90553620
SHA1 38cd72f6c07802851957ac7b7189ac32fcd0c894
SHA512 e91fa470c63b0c3dcb49d8b115e79d69a078e1a635127da64d53750a43fd222b752e1edbe3be2564bf2ab90f9f200a3d2ff04bd7667809188193c6964e48c8fd
TLSH
T12CE020540CD8C75ED948B6479274430CE6517A4FA6C5BDA76B048CC53001440E1D3D61
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c3fc06a73ab8dc7bea7da50b9b356c60814a61239de45b90bec5dcb089e40f79
MD5 44901194e20167e50cc052e23b234b2f
SHA1 917e9a6fb35846b020d437f3ea68deec184ad91c
SHA512 081c7e9cdb8b7a87853c0d118ef58cc020736b568d31b8400836fd5ed7030c9e19d892467f3fa8033f4b69064662a3679331b93ad12dabf7b1bf4093720cdc55
TLSH
T148E026CD24D8C3AEEA40644F63E4530CCAC13AABD6C8B99A9700D9C83105880A2879A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c402bb18103b89dba1be9a075857dbe3013604c7d08239badd3c73b2b727f15a
MD5 0571126b5af29cecec55bc1a7b9999eb
SHA1 0f5ec99128f23fc8a2478607cbdaac91e697a5fe
SHA512 977695d9dc911725cfe6c326f9972e787244e7a83083c80162d1ca262d6ff24654a80f6e5069c282d7e693896af528d60a91ab8b9515163c1e4578c958290a1f
TLSH
T1ADE02BA5C962AC2B18FD171974501642D705236B2A40491F3A7D820E8FB463E159B95C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 23KB
SHA256 f2dc8058cd189b6f6ea4ab0d8f82707435c15e057e4b3ab42bd68f962d59d8b3
MD5 d1e6eb66d6a7c2db0d5f545e9642b644
SHA1 de7b7331da118b9f2b352982d29944190257442a
SHA512 dcaaa757f5d0d5997a5370cfc92f9166bcca1f57f02f6bd170b79c8e6dcef8a4f5f332948a0bc3fd1ae1c145c3265a254716346fe0bdbc23dd796d4a5bac97e3
SSDEEP 384:mHGn3k3deRu0iixc90lQh84ghdKYtelyxmFOSIZDv/oZ5BHcSY/Y4u1KfmqlzX3S:Nk3dZFCcOK+voYtelwhV7W5BHAT7fmvt
TLSH
T129B2D02DE87CDD815707DD94C780EA024F4937578D2FE8621E1CF99C02E6B0BB7A6686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 37KB
SHA256 b7b4fbcf2965c946c838b566a8135201e6ceb04ff877a1030e7f54112b142aac
MD5 063d5ed761bca4011092a9ccb5748990
SHA1 c3e2d4730598295ca5f22ae7aa8e7468d6caeada
SHA512 45956a2c2317551c6506d7f5cf2172fe4d8b7301a8d138a70fab978c408cf7a2a650a25598dc0a074497c36b2c029920dcf43a1e5776bc4d06bf7352c16f1edb
SSDEEP 768:vQpmqkIYsvw0CyBj2LdrCC2CC3/kBho/W6uK1VeD:opmqZBMICZ2qC3/kBm/W6NeD
TLSH
T1BA03F1636C1117AE1600C0A832149DE13C862651B77C11DD8BAEBEF839FB7646BA4E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 22KB
SHA256 df68fddbf408c44fe82d5923a65d06cf7da55bf595fe2436b51b04ce5a685227
MD5 5a63f5b7dfb32b86822eac0c66148202
SHA1 9aa941793496bd272a5e69afddaccdde47d3c3a6
SHA512 af7b03ab86516bbb492b4f5e5a1647ba77019dbd8e855bc0d4fcd708cc64ef3f104a26ff8541d50532dd63fad867721a9e575381e69775af1d17400a4dab0e2f
SSDEEP 384:V1eZEJbzH55T7LtIlX7YPQ2YEgUhNSbgExZqu4XjOQYR2joOIe4EHKXvkSwcMmFP:OZEJbV5HLelEPQ2YEpa1xEu4ytR2jseG
TLSH
T192A2E14EAAE4CD9F4EB7CF7F5255B804444C1CC8DE559E85483ECE0D9F91968E336484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 221KB
SHA256 e0922737b202609acaad419911bf771eedb4efafff862c9d6247de53389213dd
MD5 163af4fec0c00ceaae96d9aabd216e05
SHA1 fde193808dda5fef6665396e13de3b1e3c034058
SHA512 0f7f2be658dc91dee5f8dd6476cb3637057f1c2cff98e4721ec047f596d61010c91e56e49ad4adad63b5d4c3ba75295b840856d9dfb89959d4dd42193eb1b22d
SSDEEP 6144:7eUs4b9CaGZa/EQbJmK4Ehvgfk8LzccWDq+z7Fb5HaS:7eNM9CaGZcfYK4Bk8nccWDqKj6S
TLSH
T109242396E1D9B03A2787E25902320503A4F202FF852069EFDCC6BFDAA5117E5ED5F4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 36KB
SHA256 52232e8d7fc107d21ae83901be8739fd141708c7513f3dea43d3458d7130e521
MD5 0dc99cef765a3429e67f42c05742644b
SHA1 e06448aa7476eef29bfe9b852688ef8525222018
SHA512 cb08488d6cba5ede94f9adf1a49d46581125c00921a466b0c74af66915ddd955b4b2034f5cf48aefaabea4daa306f02066674c4ca6a58cab3e933cca71c63b73
SSDEEP 768:SpOT8AG+fbmu4ysjEisIg71HCQ4/hDqKi9d+XdrJ6NXn6MmkHkSQ2nf:SpjAG8LeEn6hN2qdJ6NX6MjHkEf
TLSH
T199F2F20DB90EE64C35901720BC635596E70715C563385F6057CBB4B0B5BC81F37AAABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 22KB
SHA256 5692ece54db78aba10f61390490a8a0a6c5644f059b260cf1859e742e00886e7
MD5 233dad47535c14aeba283168f8f8770e
SHA1 e05cf61ead67fc4816782fa2d8be81f93dde3539
SHA512 aaab9bb9f19b1389354ef1695992de7e3de6966730314f98ed7c466c681335162f06e023f64c7f4b5ff55ae9cc3c2e785eeeeb20ca2ce44de787e3b809dadba3
SSDEEP 384:iVYi7Yfafw7f+yx/76AxTbT6yeqzPQwTpqE0lpXt6UlRgL2cfkg1L:KYSoowSAtbTwo4plpXt9wLkGL
TLSH
T1FFB2D1583B7BEF88F639A709E1D95121B94779E0B9DCBB6F209F02152511022E3880FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 17KB
SHA256 45141a2fb6387b6590b053ec98bbe02d5e631556d9e933179849b94c491ec7e4
MD5 5fd5e5ede46cc31f04a6454186485c6b
SHA1 15c327888244b260cea33f6597cdff2939efecba
SHA512 c85ff9be0390e010d29d5b545952745da11901d20e4c4f04f406e79c6810ba3cde0a7b964005cb38f3c65cc5033565b4436417d12537c8a428439a86ba03afe4
SSDEEP 384:YCaUr89Uo/x1qpDOISdG/Tk+El1KXlL/nta+F4Wh/rZ18sCLemob:baReYzI8G7k7filw+FBhbylob
TLSH
T18682D01F96DE1020931BA143AF5E3FAA606D261E3F95B2BF188206E5A953D0D32598C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 29KB
SHA256 df240b90c6e81957f4be038d8651390c4244ae2906b28612ab78690f449560f6
MD5 47ff08bbdd92c10e80747aed6746d71f
SHA1 ace8ebd71817150a353c90885d26aa13f3460b9f
SHA512 87039869d96e1b2fe45c3259b0142910eba392e7ae53a114e5d853162554ca03a66c35c967c771b04e94c264cdda9fd651bed1a35f38e2d03a461ac2fc900bc5
SSDEEP 384:PSXV4LyP5eb0oJ5NDagxfCOWbxC6jLKeGCIfizpYgPQirJJEu0y3B0jvsNKwcZ75:PSFEMoJfDagxFW/GKfJKABewWAmN
TLSH
T112D2F116BEEB3F104C9DC5833E28CD56CBC5379009A54823633A6B4C54B25A74BD93AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1
Size 21KB
SHA256 a08c5fab4e888e730b813c97a3c00e51e20298368e8240211847fd350f358da5
MD5 1eeb464459ec173bdeab0c43b122946e
SHA1 438c7d958ab4c0204eea2cc121fdb40b27bf68dc
SHA512 185e1b0b532874908acfcd3fd2c4a2ac5ddeab784c95f2c793d83754ab5a7f5d861322b785eaf46ff0e81893dd4164ef957c44f16ebb2ee9654b90f34ed4f2d4
SSDEEP 384:h0AtANtCmTqXN3PQ+UGj/vKo7hBlbIQD0gHhiItTwtScPGDJm1uVIIkJh7sFIiaC:hUCfXN3NEojlbIBgBrTw0cKc1Ik4GZOB
TLSH
T1DFA2E01B27B36DBA85ACDD0AF9958EF3624AE9C1D444A3451C0A003989EFB29D45C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 73KB
SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
MD5 86ab42d92e8aaa951eed274da507ad23
SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
TLSH
T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000102

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000102
Size 81KB
SHA256 04b62538d8444eb895a6ca6562e06cbd8d9a635c857c1db09e527d0914fe65cf
MD5 ff403001173886650e1c1929e2947b4e
SHA1 8f364541c0a71bc5ce3db51838d1ca368eadd99f
SHA512 75252f9d6f1bdce8fdae4820fb5b6579377e5f8cbb5dfdca14e964859d00abb9c1e395156b0a7c2d69c399497557f137b9d5363bd23ee22a0ad5f977f22fdf21
SSDEEP 1536:XOdQPfuQ1k0EO5bpNh5YeiIfHwBi7/vu7tpvWN3f28CzMzdaiXNrZI:XHf/+0l5bp35Bl+i76p+h1CMN6
TLSH
T1348312C725C00255228F714DC5B98EFC9448EA22EEC465FD1F7AD09DCEA8D8BA486DE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 0526d18323506e5082bf5616b8235e37aa56dc4b5fdbf1e5682e5386497c562d
MD5 150663a268c78ba1bc8eafea524b3973
SHA1 34a278d308585bca3fe0be4f1b4b1d85e464c9b6
SHA512 21269055f00bfc645da26696ab05b9ec683adfdcbba56810f8ac5a96b76a207fb3f9ef0a411d8b128875b29a63d5f32d46f1b6392c02f36c7ae769577c925d74
SSDEEP 96:jamVhEi22aUaxwK4dSDFSt+eg4oszg9Yb52gGxgpH/BhpkOr8h/H7n3GtI6L351j:jBEDodSRSYuF2H0Hh7q/Q11j
TLSH
T1C9E1832520A7CD24E76F3CB8E9C35946B8E03A9FDA835E173AD0DFB157072A00959224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e1bbe8e2e45f18912fee276c26b5b1ba0c2ce1f42d783924f345aed038f9dcbd
MD5 4a51530ae776c687b431cd876469f93b
SHA1 9cb9b85bd05f3be78336ed804485b34f34a8111d
SHA512 042795eb177548462b21b6857afef7b124b04336aa308cb510308b7a4c8e6990ffda723592e097652d7cc9f18c0df54211e75d357846313313c7404f5959e821
SSDEEP 96:kVhEi5QYaUrxwK4dSDFSt+eg4ZsHZgE7Yb52gGxgfH/BhpkOr8h/HXdm3stI6L3X:gEHvdSRSYp0F2HeHh7q/3l11v
TLSH
T19BE1A72560A7CD24E7AF3C78E5C31D4679E03A9FDA835E577AD0EFB15B072A00858228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59e2c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e2c5.TMP
Size 2KB
SHA256 4a9f72f005a5168fd31553f9ce43f300d87b6829397bc6df9b79a319a02f8700
MD5 720ad4a8c23c884bca68cb5d3d57dc4f
SHA1 e80a9ad475b0d3c9a2248e8420102f8376fecc7c
SHA512 707ec1d2afd6e54a60773a90ff41fa2077bef661cf710a2bd978a704f98ec92643cb4791757d407e83a6ee133cc1c72ce37665393e2932f753c6507bc046a927
TLSH
T1F9515D7575BC45AEF3533E70A98392937DE0708F78535D832ED0E8F5971AA220D51304
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lecrabeinfo.net_0.indexeddb.leveldb\000003.log
Size 148KB
SHA256 0720d71695caf991c9447db09f9ba240d91a1b84e601d478548b75e31e6b9cc2
MD5 05460ceb1c4aed3e735840f60e0e835f
SHA1 03dc91424c6998e6ee3cf3d3d334d553f69838c5
SHA512 4ed8eea9b3373d4e40a3afead9025db7757488669b2798caa74347f1de6f01a4a9d742b327df58e8904ede1a79ca6e0073efbad8e0b2358053bb9a2ffa07c79f
SSDEEP 3072:UMJ0h66HvnIxog8SuM71zwaKJfxKIzqtYkL9TVAZ:u
TLSH
T199E3E97B10A0BE795B720975D22A3308BCF36417BA46C2C9FD4DC0A05BB465ADD72DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lecrabeinfo.net_0.indexeddb.leveldb\LOG
Size 353B
SHA256 91298ae01d7f9235691388888f717dd8edefb2bd6f422bf4cf4dd11effafb988
MD5 bd3b446fd60309c030ab3b7bfdca8532
SHA1 480fa92f66004785b96d783b985f80ae34966c17
SHA512 81512c416129b3ca9dccdf58fa2ab741cf31e8c3a8ec5093407e605c00b7d72786270edbaeb2b72328f93f74becc1c68a26a3fd97858610488bcc5146028c89f
TLSH
T1DBE0D854C9D9CA1FA72468E39524AF0CDD93A90F9784BDC5AE40D828B683088E46E551
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lecrabeinfo.net_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 51KB
SHA256 032ef9afe19107eeb8d054e83d7b071b521c42977537d1a9ac73918c2928a2dd
MD5 657ed31edf367e7fa58b27dda1988a3d
SHA1 f5affd16f2230ec96faed0296d716426a52f30ee
SHA512 5c34fffad7b0ff1ee20fcf875e73c2e8e946294e3d32f20ed8e372ce5d9a313900a1c738744306c820114a19808751586c3d6e826b3910ed2946ab8bf7d6e23f
SSDEEP 768:hHX81RHbnWMvnp+bYXmXnrMTqDVew989DPEQ:oWRY23ITvw989DsQ
TLSH
T12D338AF383F4CDAD893992F25A153F2ECE581629435C386A8AD6DE47E3E2032D15174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fffdd0a652cea68385ea7f7d51e06a696dbc8ca11419e163124d6ec5c8c1a4d3
MD5 21b61a3442beef936cd1c94344f65c2c
SHA1 a526ca2e680e73d541a940db7028720c50af0bd4
SHA512 239178bebd47fb96e07fe3a908c539288d3ccef3f2a11d821fc7f3d2b6f9118e1e1a743f221dabab790ed776a27e2d5c2372b7da441d3fc99b1d42d5c757d6c9
SSDEEP 192:sxZFRuyMqZjK1Ml8MFz/fas3/gZKQ7PT0RzodpHO0/W6+WNrLP/Y0ZNpo1gkIgjc:sxZFzdz/fas3/gZV7L0aL/b3/5UgIjJm
TLSH
T1F962F9166A785D77CCDBD209FA457B53D7F91563A2904E44AAFCCB1C04E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f65e097746324a49a9a7c7d14e46e8d8b76bd303cd826816a89d3d0df365623b
MD5 e2163377a56bb7aaf65040fae4be4996
SHA1 96a875b0b90336a3f49a3a7d7034e7d62abe4818
SHA512 284db474618b469d77a466516c106b1f4941e9b1ecbefa92d948c15eaef0c2525d864e1a317a57e9b61bc722e0f458e1124e196ff0cc84d84a8d242cd485dc94
SSDEEP 384:sxZqzQz/fasJ/g6V7/0aU/bz/5RgIeDJm:syMz/f/g6CH/bL5RghA
TLSH
T19372F916AA745977CCDBD20AFA45BB53D7F5156391904E44AAFCCB1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cdc48adc60f28f53f255b944f9309563c32853ea44ba45e2dca8e914e615c774
MD5 f785d7dab08f8f664c276b9b4d342102
SHA1 31c707d5cd82bd890eb8ed073c166f1b127a3d84
SHA512 32d32227b659597d60b0028395288272efa669f4da9b8f26ab17231fc41ee771c7ad2cf15ff336df4fc786956be19881d690f03bb0fdf2750bf36b854d974aa6
SSDEEP 384:sxZqz/z/fasJ/g6V7z0VM/bG2/5QgIeDJm:syzz/f/g6mq/bn5QghA
TLSH
T13972E816AA7459778CDBD21AB945BB53D3F51563A1900E44AAFCCB1C04E6BEC220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6232bfd79426633ce1086991e9dfdf82deae4aca3133cd78b3ba3492547b39ad
MD5 f4ef18c454a3047506b8bfd0aac01e50
SHA1 7d694dc1767ac7b9edfb374cf6499cacae673988
SHA512 c23368b9bcc1e3e4f7bc510743f828049dd2df36488cb3e43c5fb3a98592b441800ea8a94f0a4d56c5a01b257145b4d0f595e331f817a5fcce797cbceaab1e4b
SSDEEP 384:sxZqzq7z/fasJ/g6V7z0VM/bGg/50gIeDJm:syO7z/f/g6mq/b550ghA
TLSH
T17272D816AA745977CCDBD21EB945BB53D3F52563A1900E44AAFCCB1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0dc0fb9144ea796d9550509428b3774afe788a480b5de36b3fa44af52d7ad8a4
MD5 a9d7f872b5a853cda67e2f78e6f01514
SHA1 526b636c3658443e2952d90146568b34eafec42f
SHA512 e79b80e2dced729501c6fb3ca5ae9fecfce52ca7fadb9733663d0de7e5160816f55a9f8fe090a8e73008512467c3e05f910f9f57513e1feb06c1bc78d61fa041
SSDEEP 768:XwZh38Dv2aFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro1o:XwZh38Dv2aFWRm6GQFmu1jaK09LplMbC
TLSH
T119E21B3B280CC77E4F844E9DEC266F966ED802CB66684D5447FA894C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dd5ca49b91a590cc0fc1bfa1aa2361941bc48b64\f6ad4987-7045-4912-9298-93d9193e301f\index-dir\temp-index
Size 72B
SHA256 008beb9f680c634b6dfa7ab58eba6f8613434949583c2983f74a179266c0fb36
MD5 2018deb2961a3ee0b6915ae2f4cd3661
SHA1 c75125cdf57072828e67c85fddfbc728d7bb0c41
SHA512 9ae819820ff98f1c3d7d414cd6aeca04faeb015e9e664cdd92f21a2f48e29f08114e0c87cf0f3d28842110132abf0d9b5acf867a16c445a4bfa2593694761a56
TLSH
T131A002E449424032DA091373A9939B823A009D6345306291BAA4118C99F83496101207
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dd5ca49b91a590cc0fc1bfa1aa2361941bc48b64\index.txt
Size 56B
SHA256 f6d74a71203374de124a1527952cdfc50b3ac7b8422cd6a841890f5524148bdf
MD5 8389adca5eec18dd190be65b8c28298a
SHA1 d5f6a2af2dca39dd56957256f90b729b49acc3df
SHA512 e51c1e2b554db8102eba45810a1762f7939a00526e8672f92b11ddb87a34bcf3c032ea3aaa6bb22b8dd2967984533744aa5336962a1cca2d3ec42f09d6bb11ec
TLSH
T1EB9002BB8A020313261221A3A32A23698C06B10E1A80ECE0E021802EBB80B28B881448
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5884fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dd5ca49b91a590cc0fc1bfa1aa2361941bc48b64\index.txt~RFe5884fa.TMP
Size 155B
SHA256 ffc6ac3590efa5d09ec6bbba80f80a80e57c48fc0148731a55ebebf18de8a6fb
MD5 7d9fb77dd6a66440cc100809da51f017
SHA1 68984953885fb21f7a9c73426fb97868250d8838
SHA512 28d00231e65ceb94575e33edc150bd60beec6d520c96164cc0f7ec7181ab829c8160ed77301abf17c74b118674710fdf4d97eee123f23f2f31cab9ab523d8aea
TLSH
T1BCC08CBB8BA6022A3331A27AD32602A5C8262C0F0A41E8D4B006731AB731A35B6D100E
MD5 SHA1 SHA512 TLSH

Submit Download

537e76334a2aab53_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\537e76334a2aab53_0
Size 189KB
SHA256 896754778a6ae63ff1830f0ea7f78a4ef0adea10568c9dddebfe1798a5224c23
MD5 b040bfe75238d1dd15551b2bae33c981
SHA1 1e8a96eba35c539c0ba000ccd31fe4d68f8308b0
SHA512 45b1fa9a2b6747154b84bbb83603969e5496ed81b9cc475947da5f9e3922d68d6ced43353bd18056125d35e11f6e0ef308aa3316d115d761341b986fc21501aa
SSDEEP 3072:TaIvpNzB0SIWyQPg+9buFIe3XrfAyYUu:TaIRNzBbIWyN+9CFIggU
TLSH
T1C2145C716300F43BA917DEA1A27F7F4E3C35A167ED0686FCA594E930EAD2DF20521648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ef526fae07727f0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5ef526fae07727f0_0
Size 64KB
SHA256 850a5c72c5823f11ff92f96599b44d9155efa9bb584901e5828644861613e69c
MD5 728a5052e4a068f83cb554bf12ad4ac1
SHA1 5ab529d30ca1664d70b19e7f8fb6819f998c6991
SHA512 da259a4c39414a6cd099c22354054fae2681597926ff68f361a8cb5eb04d7acaa0c011de7fa50ce067b58226e033e53eb4021e7dae77bc68634608660bcb62ad
SSDEEP 1536:p8k3vI6M483O4uubRX1yXbRxkY8Yf3iP6O:p8k3vFM483O4H1bl
TLSH
T10E536C96337174B7427BA1B1909F130B713EE167B404C4E8A288EEE54E54B9A4277FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 534cbd71a694fdd2ed1658dbe7bb14f77b2136718499382df46a71554d456ada
MD5 2e862ef8bc38c39dff84f4ec03f03267
SHA1 405e576a42cea9d8a55d994270e6b2aa882e660c
SHA512 ace113ace033e166368b9b3ffe2eed553eba56442fe55689a7063e617e74ac124d7f0655c65a4e7db2bae8fe7470e9a00b4f41c5a25c5818e43934fa0f77572f
TLSH
T18BB0121154C29143CD0E4B3B17C0384036659D6016C1AF17509044008A241D29702C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 192B
SHA256 f49acd5f0604e76cb0463b3f5520e6eceb497c916e5fb224e9857941145b522f
MD5 750fb064d707d0da96bae3c587f3b806
SHA1 2c501ff6b53552c20e47eba0fbd9483aad3f93e5
SHA512 009761e113cbc17c9ac314a853588e80135f600f98a5e58b9351420a1e80904464d7cb8f4e998a280d2bcaf45a6a36c4dd56e55d69b348e8b95967c357b7ac79
TLSH
T138C02B9042D01543CC1FF73684C0108123348E5C4F437743508952064C1D0D38C52D50
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5b0c25b64ec554ff0358626cfc0db7f95696bd62f803abf647a48c982f76fdf7
MD5 1be20f16be50c85b580c9953801ce888
SHA1 3a9f3892e1b2e47e543d6485aaa57c500368e4d8
SHA512 271a70a09877b8b222c66d64904af0199991e08c0e8462327ce132594f1bfe0dcc2bb0efe7c39d053a6342fa9ea66d189e5c74c675fb88b23a0b016688cb8d3b
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl1Iha:ctGj+BCNC5qFVpKx1Ua
TLSH
T1DEB2681632BA02033C3D791D87A59B371A42B1633418E93B7BE954BA4E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\0063775f-3597-4c3c-a85c-da943bcc5182\index-dir\temp-index
Size 72B
SHA256 cc06aef3fb867843e283e2509bc1aac335de3e27798f0a21ee3ad8bfbe1efa66
MD5 db5c85c8352f7dedbf5fb78ea9e19675
SHA1 452c75c820441ab863a9f0b2db06a7edea6b0575
SHA512 31786acf71b901f16286261484167d1c9541a207cdc434de0b4e930b61009453d32155f4f18059eea77514aa1c6e89f7d9c0ab68b6d0960ded28a8fa34cb593f
TLSH
T1B2A0021545990827DC99137150C347983E416C1004095341B79000C79E787467349605
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\7b3a17e0-74c2-47a2-a1a9-a07048267ed7\index-dir\temp-index
Size 72B
SHA256 03866f1b2171496b609b6b010eeb8bf97330ed2e95c93fa1770d2411600e900b
MD5 0e691ce9a3fe8223cfdcc8e333f740c5
SHA1 1d03b520f52f7fc56e0cc447821d99609b7b8071
SHA512 7bb288679a06d51aa8d55ca35c7f4de8432fd45b537ce6d764eed2a27066b16ede23f66f2cfe44640c59cee4bf5ef3140e2307d58284244bd2f03058d3bc52e0
TLSH
T140A0021412524402FC1643712487175A7B414C20113067097AE00894CA7A2527111206
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 179B
SHA256 cbf3abeae7ad9f9e13e2c52f88b68b814cc36ff614ae81ff40f26dce9a3ab512
MD5 7b425c5eff80c886ac2561e6944558fb
SHA1 d505e1718fa06b4e2816aaec4731df0be26bf084
SHA512 0bd8b4ee4e5ba7cb8aa8cf8b4924ac5d5a783506bd78f8ca1aae77eecbdcb2719375729c71acdcbd8984fe3fd9e6418e27e863122882505b7d96af96529c519a
TLSH
T106C012FF644216025A7131B316843014C833928C0CF4EDAD6410805A366F3D12842A18
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 278B
SHA256 bb6ef9f0bd836e056829620e0b7efc8f46ab6195e91a564e453f87b038de8284
MD5 a60f0309ded6c519a6e7bc9c3ce089dd
SHA1 30bb5210721556bea495a85eedb4a45e7e875cf9
SHA512 a4849781f5f08018288dfb3b0efe14c40de4620d30aa3558026573dfd433a19476e1554e80194ec5ec649444c6bd22fb595c2d7b9880d0a8eae66491ca225243
TLSH
T169D02BFF24451502593022F396842016E8369D8E1CB09CAA2421B105B23B3C36482B2C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59f301.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe59f301.TMP
Size 278B
SHA256 f826c83636750241e84aeb0bf4d85af1fd54f62a7cbde0e14117cbabe4a76cfa
MD5 0b176ff23447e4859cb9b7ffe86f9734
SHA1 a5ebe071fa4728a0401d84555e53ba1e0d0ebedd
SHA512 eb1e87b79c2858f49fa6cb73f39f45df523d1d0d4c9e73e46a5d265327189fbcfaa242c5d89b6d005b2a42312ae48229af5e06b43b23754394732e99cd7c5aa4
TLSH
T1DCD02BFF35811702257132B351442014E4328E4D1CE0ED6C2411E047323B3C33587B0E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e9e70802dbf3c4170ad26ac52c95754efee42f8b753137776c58f7bbc59bc1ed
MD5 ec5369a76875a0a90cb4faefee42696b
SHA1 8280c85d22fb3ace20d95618db77d9c06d7557f3
SHA512 11e7d8ab58ac7540828b1873f065ea950a5c58b676fd4a5a3d976f93bbebb9d2cc45b80b340a4a1156d3c274595128a11104b4c33f228464f09f18ba6927e44f
SSDEEP 384:nwiFiZcIW38N68TUNTUlIRlrk6flGm1ifbAoC+qrVSPd2I+Mb7DvCCAU2/ty/7Ih:LFQW3FwgU/SoLAIP4I+MDvhAhV
TLSH
T1DBD25B72DCA8DAB7ECE74B99E78A36179EE04163D58C8AC4D5DD1D0D00876AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 037fe21db29b74abb12bfb6593e598469a9d5ac4fb20916776e83b7254564d55
MD5 865f2750ea7224c995643ab37019fdaf
SHA1 dbe78d8d1dd603524073d0f3f60713b413eec0f4
SHA512 06aa9ad69b3ebea4e0773ab26f010dceab47f88cc5e4d44e7623ff731cdaa6c9df6ed2bae6d2368c9af5fb7577e6ccd52546a6f97b15737521234d2eae0b77c2
SSDEEP 384:n2iFWZcIz38NtP8TUNTUlIRhrk6eTMn21ifbAoC+qrVSPd27wMb7DvCCAU2/ty/e:dFEz3ePwgUknioLAIP47wMDvhAhV
TLSH
T16AF2C3F298D78976E89E4B57A77D2E029AFCC153B1884A84B7D81D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 20d2ef6534398d025a1d5c89e579e05f3106b62c2e1de12839100f822355819c
MD5 a30b13928784cb023e3cfd883fe26eae
SHA1 e97a37a4bfbfe30c3a4e1205af309e06e3a8ab74
SHA512 edb3d3b83764e1c30417ba60d625324d17919cc901af009f3a6182b367d2df75b80bdfa74bf7c55e76e8ed215c63732f1e5888a7596f24f34744375f7e02bf96
SSDEEP 384:n2iFiZcIl38N68TUNTUlIRlrk6fRMn21ifbAoC+qrVSPd27uMb7DvCCAU2/ty/7y:dFQl3FwgUtnioLAIP47uMDvhAhV
TLSH
T1B0F2C3F198D78976E89E4B57A77D2E029EFCC153B1884A84B7D81D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bff96144ff56794735ff35412be060d85565857605e28cc9ce91af834a65e6bd
MD5 7485b05f7760489fb00b18506b127507
SHA1 f2da692758ae051dd962e8be7e810dd37a6e5151
SHA512 0f01562ca0d45c5c651728845c5ed321c8a78c8089cf3f02feae09ab56c94c8669845a67379e951b8de40c5651cc69cc454802b0fd679546dbf4d4bdf1ac791e
SSDEEP 384:nKiF9CcmyWCs38NA8TUNTUlIxBrk6ZsgH1ifbAoC+qrVSPd2IRMe4KV8p0Uxty/M:BFccps3Dwg4rgBoLAIP4IRMI8p0W
TLSH
T1EFC25B32EC99CABBECE60FA9E74A3507DDE05263C68C9AD8D5DC1D4C009719D530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d4ef36ffb5a9f2da2e66959da5137646b47416c95b5ee34f375393f327e535d2
MD5 b20f993bd9abf879d0fb73dc111cd235
SHA1 6f742d5e3b8c00da6cf7be5a92d5acd4aec0cb72
SHA512 23462b3382c4bcf2350b22c2a686a923a011263355e13c26b52f4610c7f2e174937e3b16da6b78715847f7fb7d30cca67ca5af8ee5d9156cecafbcd565a2f2aa
SSDEEP 384:nPiFiZcIW38N88TUNTUlIRlrk65Gm1ifbAoC+qrVSPd2I+Mb7DvCCAU2/ty/7IgI:aFQW3zwgU7SoLAIP4I+MDvhAhV
TLSH
T115D25B72DCA8DAB7ECE74B99E78A36179EE04163D58C8AC4D5DD1D0D00876AE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 020491a04a3bbb439635886049ff82e5c94b34f57fc51ef7e5b000a338331873
MD5 533c49bb8e57749b2d1abc0d8228519b
SHA1 6c8a56f18450e18b976987c74fd606ca51cdd773
SHA512 e14fc22ceb01e5d9316556b2cf49aae655bfaeb476b77c8ba094c0cabcd263849a4c87d2324238c2c564674d30542babaaa7e117656b8fccadaca3ed84c56fd7
SSDEEP 384:npiFWZcIz38NtP8TUNTUlIRhrk6eTMn21ifbAoC+qrVSPd27wMb7DvCCAU2/ty/e:AFEz3ePwgUknioLAIP47wMDvhAhV
TLSH
T139F2C3F298D78976E89E4B57A77D2E029AFCC153B1884A84B7D81D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 02afec8a258da92b39707ac7d0ae26921b2ad050c9138dec74a9c54362185d63
MD5 fdc6db40aa5fbddcc6075b926ff26070
SHA1 4f25ea1e9184d50a138800f95320f631f0bcfdda
SHA512 5801448ed4a50d8ed2069a78564fb24c994e60054fe94de4cd5479f9975fc7861292084a67c1cbfaedbc08e19d952a162d6a198fb006f88badcb8868275f0969
SSDEEP 384:n2iFPZcIz38NtP8TUNTUlIRhrk6eTMn21ifbAoC+qrVSPd27wMb7DvCCAU2/ty/e:dFHz3ePwgUknioLAIP47wMDvhAhV
TLSH
T1BBF2C3F298D79976E89E4B57A77D2E029AFCC153B1884A84B7D80D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1f2c609eeeb6aeb77ad8e556eb6e30cfb1e3ef9e7412e752aa617ea061d64721
MD5 487a7750fcbdd9bb5780f69bae9fb3b6
SHA1 daf11718c5ad18c86f6507881b17e7773d3adb76
SHA512 ac729895b75dba00343d227f4e41be12d7eb887278348ab24c4202fdbe376911d0870a0e13ef0ae5251b9b4eda71796d3a7c0bde4197f9a1d5f49ec6b318c814
SSDEEP 384:nCiF9CcmyWCs38NA8TUNTUlIxBrk6oi+F1ifbAoC+qrVSdSne4KV8p0Uxty/7IgS:JFccps3Hwg4u+7oLAIdSnI8p0W
TLSH
T196B25D32ECA9CAB7ECE70F99E74A7607DEE05267859C89D8DAD81D4C008719D134B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 cc0dae20165e61cbce52f797c6b8e0cf8032b2ea672572d7789b20386f98248c
MD5 f75d44b2fe34f69bc98d2e54604c52e5
SHA1 5f2ab2ea89532d63b345840091924d5217efafe4
SHA512 342ca4c66a940784b1ea9b6d4ce814cb06c9f6f1ea95cda9104fca9e0ea123a40d15ea24f869b49e66261194489083ebff6a2242cab819b151c3e2696c670a03
SSDEEP 384:n2iFZZcI538NtP8TUNTUlIRhrk6zTMn21ifbAoC+qrVSPd27uMb7DvCCAU2/ty/e:dFx53ePwgULnioLAIP47uMDvhAhV
TLSH
T1D1F2C3F298D78976E89E4B57A77D2E029AFCC153B1884A84B7D81D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 845d00e828175813b884f0348def439f83b855337ce3669f96a6f80258246870
MD5 c89497b60fef6ff03561a1397e4ff1ac
SHA1 65edb2d33c5de6dfb45516f7d2b8a5e433f7ae86
SHA512 c4cc498742ed5f63c7556daceafd3155b68e359da873e8dc56674206c0bf25a50d4d86e6cd87d63a699d08e31caf3dd63043459caf8c8e655505facb73035fd3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d3f34d60b345cdc119ae43dcdea40609b4eeaadff44fff176882226377872178
MD5 cc817b0b342008ac21895605a4134104
SHA1 96867664f69b08829e569eabb30a4ef5f005beca
SHA512 1360cd0f20b63f9f5c151e907e149bd41242be8b96138b346425a80e8088ba2c3befd2ac430cc3d720e18ae488f855940ef01e009c39631fd463a1388e219d6e
TLSH
T1B4E00243D701006FC039077040C31B74BB71C01043C30787D66101B93C217413E309C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 214d58280a70047fed23cfd46d5b8c26a8784deb47a937b471872995e6a55482
MD5 5ba391f71ec805c83726a4d86f45c3bd
SHA1 f09a25466427f7c3a34d8686e84d077b3890d30a
SHA512 ca722939db96e4e184c7983f2e3d42d05364ece74572dbad3d650bc3bd5e3452cb47f9f38a324eae2c8b8043dddf326ab3856fccea3c3334de86f421f2a0256c
TLSH
T1E2E00143D70140AFC039077080C31B74BBB3802043D30A869A6101B93C217412E30A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8ca05bde127f93aad68be6558bf1850ec6ddc460bcc5c1ff8026776caf591641
MD5 6500f63d1714fb858b15bf26979056ab
SHA1 7be981b26ab9a589db9d4a4425798448dc8069a7
SHA512 625c74202657a992f47dbc48edb2db49e305e6251dd6d8bc86776b101d880a1292369199f8a94e61de29c5fc6080b2170863c9d5fe645d0251e7ff3980f080bd
TLSH
T14FE00143D31140BFC039037180C31FB4BBB3C22143E30B8B9A6101B93C227063E30A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58341b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58341b.TMP
Size 392B
SHA256 3b98b74ec8a09ac93af934fa65ffddfc83187b9262dfb1b06036e5ae62943cea
MD5 6e7897ee369a7657c321363a31eedce6
SHA1 109359511ee982a19ecc1fef6be6494ec5620c8c
SHA512 b5af6f5c620721deedebc7c6ea036e50a5d4ec9c9b685fcf0a338ce0202b8efc680919467c49aec97969b025558c997b87151e57889898babdb4aefbff3675ae
MD5 SHA1 SHA512

Submit Download

KMSAuto++ Portable v1.9.9 b09.7z.crdownload

Path C:\Users\Admin\Downloads\KMSAuto++ Portable v1.9.9 b09.7z.crdownload
Size 12.4MB
SHA256 492cfc6e9cdcb08f3e01203790204a50ed20cce30906ea54c95a60810e3f3e91
MD5 56d3765e3b1c1fdb59bd50f4622bbbc7
SHA1 d895bb824a29efa912a6e8a5c7e5ea42a4005de1
SHA512 a729d9ea0c0ba974a1862e3ebd9d051bbaffe3858169912b1ef698f9b0468d497f34517a3917d4515b30f61b93563f69f2fca86e1a2c977bc62925b0cb871df8
SSDEEP 393216:ZiCOexC2a+7YJQHD0pTT9e1/hNN0quL8Ix9vf1iSYn:ZDh82j7Yy0pn9erNN28I7oPn
TLSH
T1C3D6336E201DCDA775A5E96C80ED451CE8BE3338D95E4AE9CFCE555DAA12C0238C0DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5256-281-0x0000028CC85E0000-0x0000028CC95E0000-memory.dmp

Download

memory/6496-1373-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1377-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1376-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1375-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1374-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1378-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1379-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1368-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1367-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6496-1369-0x0000018414BD0000-0x0000018414BD1000-memory.dmp

Download

memory/6588-1389-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1392-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1391-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1388-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1387-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1396-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1393-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1394-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download

memory/6588-1395-0x0000016D47C80000-0x0000016D47C81000-memory.dmp

Download