6744ce8560f99930691c1035c9ccb2522fe091f6c4ea2ce18ac2bbbfebb24ebc

Analysis

user interaction
yes
max time kernel
1050s
max time network
1051s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GameAssembly.dll
Size 14.6MB
Sample260820-xa85yahk71
SHA256 6744ce8560f99930691c1035c9ccb2522fe091f6c4ea2ce18ac2bbbfebb24ebc
MD5 1db78725c337f6c67b441771589dcbde
SHA1 045cfea9487fb784e4e684a4b871bc4e7993fd75
SHA512 c7d489ba40345fca41724e7a8ad63dd570ea2c4203fbef04aa1a74c45c584285e6aaa775321840f7fa4e13b47df7dee41e82f4c04789c78c215286ff9893a62f
SSDEEP 196608:q99chDTDS7ippgbuUTXYUYYxRC0G6wIhSjIz:qzchD3S7ippcXYYxRCRPjIz
TLSH
T198F63A5AB7B58448C07AD2388A13156BDBB238041FB867CB21944B9D1F737DDE97AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware upx

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
8564	GameBarPresenceWriter.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/8612-3543-0x00007FFFD1DB0000-0x00007FFFD2CC2000-memory.dmp	upx
behavioral2/memory/8612-3540-0x00007FFFD1DB0000-0x00007FFFD2CC2000-memory.dmp	upx
behavioral2/memory/8612-3552-0x00007FFFD1DB0000-0x00007FFFD2CC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_1366193226\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_204195403\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_1366193226\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_204195403\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_204195403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_690850276\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_1662235548\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_637031339\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_637031339\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_1366193226\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_204195403\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_1662235548\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_637031339\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1876_2052886656\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_204195403\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1876_205251614\_locales\gl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2724	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Granny.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Granny.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Granny.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Granny.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317249980754716"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{0564A53D-DCF7-4221-8327-046B285CDC9A}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{6B03863F-F2C0-4343-8BEF-EAE6D1BE9504}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
8612	Granny.exe
8612	Granny.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6464	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2648	Granny Legacy.exe
8612	Granny.exe
4468	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4572	1876	msedge.exe	94
PID 1876 wrote to memory of 2724	1876	msedge.exe	95
PID 1876 wrote to memory of 1508	1876	msedge.exe	96
PID 1876 wrote to memory of 1508	1876	msedge.exe	96
PID 1876 wrote to memory of 1508	1876	msedge.exe	96
PID 1876 wrote to memory of 4872	1876	msedge.exe	97
PID 1876 wrote to memory of 4872	1876	msedge.exe	97
PID 1876 wrote to memory of 5736	1876	msedge.exe	99
PID 1876 wrote to memory of 1304	1876	msedge.exe	100
PID 1876 wrote to memory of 5736	1876	msedge.exe	99
PID 1876 wrote to memory of 5736	1876	msedge.exe	99
PID 1876 wrote to memory of 1304	1876	msedge.exe	100
PID 1876 wrote to memory of 1304	1876	msedge.exe	100
PID 1876 wrote to memory of 1012	1876	msedge.exe	101
PID 1876 wrote to memory of 2744	1876	msedge.exe	102
PID 1876 wrote to memory of 1012	1876	msedge.exe	101
PID 1876 wrote to memory of 1012	1876	msedge.exe	101
PID 1876 wrote to memory of 2744	1876	msedge.exe	102
PID 1876 wrote to memory of 2744	1876	msedge.exe	102
PID 1876 wrote to memory of 4740	1876	msedge.exe	103
PID 1876 wrote to memory of 4740	1876	msedge.exe	103
PID 1876 wrote to memory of 4480	1876	msedge.exe	105
PID 1876 wrote to memory of 1240	1876	msedge.exe	106
PID 1876 wrote to memory of 1240	1876	msedge.exe	106
PID 1876 wrote to memory of 4480	1876	msedge.exe	105
PID 1876 wrote to memory of 4548	1876	msedge.exe	108
PID 1876 wrote to memory of 4360	1876	msedge.exe	111
PID 1876 wrote to memory of 4360	1876	msedge.exe	111
PID 1876 wrote to memory of 3832	1876	msedge.exe	112
PID 1876 wrote to memory of 3832	1876	msedge.exe	112
PID 1876 wrote to memory of 4804	1876	msedge.exe	113
PID 1876 wrote to memory of 4804	1876	msedge.exe	113
PID 1876 wrote to memory of 3800	1876	msedge.exe	114
PID 1876 wrote to memory of 3800	1876	msedge.exe	114
PID 1876 wrote to memory of 3800	1876	msedge.exe	126
PID 1876 wrote to memory of 5824	1876	msedge.exe	127
PID 1876 wrote to memory of 3276	1876	msedge.exe	128
PID 1876 wrote to memory of 5896	1876	msedge.exe	129
PID 1876 wrote to memory of 5896	1876	msedge.exe	129
PID 1876 wrote to memory of 952	1876	msedge.exe	133
PID 1876 wrote to memory of 952	1876	msedge.exe	133
PID 1876 wrote to memory of 2452	1876	msedge.exe	134
PID 1876 wrote to memory of 2452	1876	msedge.exe	134
PID 1876 wrote to memory of 2452	1876	msedge.exe	134
PID 1876 wrote to memory of 3240	1876	msedge.exe	135
PID 1876 wrote to memory of 3240	1876	msedge.exe	135
PID 1876 wrote to memory of 5760	1876	msedge.exe	136
PID 1876 wrote to memory of 5760	1876	msedge.exe	136
PID 1876 wrote to memory of 5760	1876	msedge.exe	136
PID 1876 wrote to memory of 5208	1876	msedge.exe	137
PID 1876 wrote to memory of 5208	1876	msedge.exe	137
PID 1876 wrote to memory of 5208	1876	msedge.exe	137
PID 1876 wrote to memory of 4968	1876	msedge.exe	138
PID 1876 wrote to memory of 4968	1876	msedge.exe	138
PID 1876 wrote to memory of 4968	1876	msedge.exe	138
PID 1876 wrote to memory of 3696	1876	msedge.exe	139
PID 1876 wrote to memory of 3696	1876	msedge.exe	139
PID 1876 wrote to memory of 3696	1876	msedge.exe	139
PID 1876 wrote to memory of 5184	1876	msedge.exe	140
PID 1876 wrote to memory of 4712	1876	msedge.exe	141
PID 1876 wrote to memory of 2452	1876	msedge.exe	142
PID 1876 wrote to memory of 1048	1876	msedge.exe	143
PID 1876 wrote to memory of 5184	1876	msedge.exe	140
PID 1876 wrote to memory of 5184	1876	msedge.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#1
1⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7fffdf9ec188,0x7fffdf9ec194,0x7fffdf9ec1a0
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,7704910303626090762,1957447946809709702,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,3056729410628836512,15314007524761551436,262144 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,558153405175858142,16013349120383523619,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,18076337545847250700,8781482552809125265,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,2698534772843179239,168441697289910979,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17610880365439811256,1265640445535643451,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3456981028452724666,18234851084184099308,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2321255487440068992,11839656882124236396,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,11926284013941019994,16519593419219774156,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,7792778945136764332,7612852041211784006,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,644800784720493456,2088776056470932100,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,644800784720493456,2088776056470932100,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,11248947660831281423,2673676649830561813,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,625776195576741988,17546365473385995310,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,11782580626050506939,4012776397040518293,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,4663048601104547896,13575253661144984861,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,18370829939978637941,11312429313256993045,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=1120 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,14510293992034454968,15255449483556006079,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,7512715675525000128,14462614385508786254,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1340,i,17030458657430962706,7125822735515097864,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,10112959891513757461,7105294964402794106,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6836,i,3148344735835532313,17419388525797983631,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,1981264277267434732,13907997758920307209,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7152,i,4412900469759134571,3562176793575240477,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5764,i,7232951630522815530,4159904075926074866,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6568,i,12624324984462611362,10542999764378958376,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7224,i,13464638395511651962,5257541661126003371,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=932,i,5059365289596072092,17657346734562708511,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7548,i,11876520677835760599,2727825838403458377,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7480,i,15103861235162952159,3765196944663968112,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7536,i,11779271519356685914,16641981622965698172,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7572,i,5580214376789533450,9691962726765547307,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7576,i,8525323246225200487,17319490596985474290,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7600,i,10999960279070911517,5132165351595307089,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7540,i,10478487395305468130,4934410955673598062,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7588,i,16422070637202483439,11834852925759182222,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9012,i,542097706740353261,3519755670071923776,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9184,i,13132379856115099607,2267105624444480333,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9340,i,6364147618702042870,15458496686364643593,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9536,i,12293475183706599032,9551559693839595568,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9652,i,6649643932704746587,5535102353616602479,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9676 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9524,i,3242328392325661734,3776969907255808896,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:1
  2⤵
  PID:6452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9644,i,9082726040118016234,9504249679155657605,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9232,i,15121887392944298460,9122957807921382322,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10076 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10132,i,2650475584801053753,17222557699031675000,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10068,i,9988535346125934534,6934630712835062785,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10388 /prefetch:1
  2⤵
  PID:6684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9660,i,6633582769141741228,17905733720063159398,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10340 /prefetch:1
  2⤵
  PID:6740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10800,i,8601190706737249817,14469914432865488174,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10808 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10928,i,11458108420274503831,10111764098689760006,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10892 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11048,i,8132715727075552073,3314987933891255976,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=11200,i,7300453987739630171,4522867501804929648,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=11376,i,15395824560019390393,16749106009588298241,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11396 /prefetch:1
  2⤵
  PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=11556,i,10481734088585353205,13277153894897857298,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11544 /prefetch:1
  2⤵
  PID:7096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=11260,i,7427648826475069824,12542635998051932066,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11364 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11628,i,11698224748313200088,17095532945136695148,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11592 /prefetch:1
  2⤵
  PID:7016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11748,i,812720499044196982,16437962796168837194,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11764 /prefetch:1
  2⤵
  PID:7104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=11956,i,5704220474973121867,8335272405645592157,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11940 /prefetch:1
  2⤵
  PID:7236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=11800,i,6957374478453927867,11354868684390500996,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:1
  2⤵
  PID:7296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=12212,i,12599731415222972118,11075853510068982657,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12228 /prefetch:1
  2⤵
  PID:7304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=12408,i,11813828865145657467,10943262720730597557,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12200 /prefetch:1
  2⤵
  PID:7496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=12520,i,6667564943252749890,1935891817123307274,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12572 /prefetch:1
  2⤵
  PID:7572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12636,i,18237517216105390367,17664813769566166564,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12600 /prefetch:12
  2⤵
  PID:7580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12352,i,10948914957604701369,915040561956138978,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12968 /prefetch:1
  2⤵
  PID:7740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10572,i,16084336328085171929,7049390427318393688,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12996 /prefetch:1
  2⤵
  PID:7848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=13160,i,4605956130720857696,14127390158284218484,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13104 /prefetch:1
  2⤵
  PID:7932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=13264,i,3689899235828978115,6712012055680209264,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13300 /prefetch:1
  2⤵
  PID:7992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=13476,i,4638342197712167572,10155435859726904747,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13472 /prefetch:1
  2⤵
  PID:8052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=13460,i,1404069132537175664,4231213922897259163,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13628 /prefetch:1
  2⤵
  PID:8060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=13444,i,7985572000867339300,12137375778246013228,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13484 /prefetch:1
  2⤵
  PID:8164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=13760,i,3531116102338508392,3813843758379213071,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13908 /prefetch:1
  2⤵
  PID:7444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=13772,i,17956287008155369284,8510235808721498862,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=14016 /prefetch:1
  2⤵
  PID:7448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=13604,i,997747205554854509,6046427352388555201,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=13460 /prefetch:1
  2⤵
  PID:7836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=14232,i,6153656123867625892,6599978726277697188,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=14248 /prefetch:1
  2⤵
  PID:7776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=14408,i,15122588026554815863,2090783869199389027,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12904 /prefetch:1
  2⤵
  PID:8308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=14404,i,3263050720781768320,18190565300330573074,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=12876 /prefetch:1
  2⤵
  PID:8364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=14720,i,9676529679055901693,8680275270678417487,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=14724 /prefetch:1
  2⤵
  PID:8420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=14900,i,3844259058475064117,6067045589417031906,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=14872 /prefetch:1
  2⤵
  PID:8428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=15068,i,15329685719416634951,1529769780166210912,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15084 /prefetch:1
  2⤵
  PID:8548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=15100,i,10475948412631319661,1714468585479632396,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15220 /prefetch:1
  2⤵
  PID:8592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=15196,i,4482804514460468265,6382035966523161978,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15348 /prefetch:1
  2⤵
  PID:8672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=15476,i,10379895519279430149,4422289778854186280,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15516 /prefetch:1
  2⤵
  PID:8744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=15096,i,9454803428786722382,13950028012767470970,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15480 /prefetch:1
  2⤵
  PID:8780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=15796,i,987874248715315320,16249405427654380232,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15672 /prefetch:1
  2⤵
  PID:8836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=15928,i,14149240332200263247,9739714503758563072,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15944 /prefetch:1
  2⤵
  PID:8856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=15536,i,14910816983475583116,161135584649854691,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15500 /prefetch:1
  2⤵
  PID:8956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=16128,i,5636764681678613879,6465963251323910240,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16216 /prefetch:1
  2⤵
  PID:8964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=15992,i,17206614396792556827,16266310992987213914,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=15796 /prefetch:1
  2⤵
  PID:9068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=16528,i,8295949555145616578,12125230737723240626,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16556 /prefetch:1
  2⤵
  PID:9136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=16332,i,11968985698525067804,6226541252480718507,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16728 /prefetch:1
  2⤵
  PID:9196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=16848,i,2037042253629373097,4883078315341923546,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16852 /prefetch:1
  2⤵
  PID:9208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=16604,i,3138632232061987420,1119921404922082619,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16200 /prefetch:1
  2⤵
  PID:9364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=17120,i,2655129392782530296,7541738826614073726,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17116 /prefetch:1
  2⤵
  PID:9420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=17264,i,4688697697011884941,12049912643779091900,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16480 /prefetch:1
  2⤵
  PID:9484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=17368,i,9471859931773999901,1888143260651156712,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16848 /prefetch:1
  2⤵
  PID:9548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=17552,i,6260272136473474341,3965739365549222497,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17564 /prefetch:1
  2⤵
  PID:9604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=16516,i,8354901119204879789,5567529155791856723,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16860 /prefetch:1
  2⤵
  PID:9660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=17808,i,6016165610729947790,3075922591528475936,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17820 /prefetch:1
  2⤵
  PID:9712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=18032,i,2134983131750573187,15296522868453475659,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18060 /prefetch:1
  2⤵
  PID:9836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18200,i,14324777683742479427,16749586074363710995,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18296 /prefetch:14
  2⤵
  PID:9904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=17372,i,8740226091891426794,15396026972227475195,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18316 /prefetch:1
  2⤵
  PID:9912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=18696,i,5295837622112755565,16996424730587872496,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18712 /prefetch:1
  2⤵
  PID:9996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=19184,i,2614625069341691148,6895084649863905325,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=19200 /prefetch:1
  2⤵
  PID:10052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5064,i,12131383726774187187,3510255251692587148,262144 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=12560,i,15838581696391908681,15174459465245589790,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=15448,i,2349289026942188998,12499798812622547936,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18048 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=10780,i,14436639112822531062,5917729128843267283,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,17285886473976913881,3969735524322197211,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18508 /prefetch:14
  2⤵
  PID:8844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9632,i,15853626100225756276,3980383464565631939,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17532 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18316,i,3255741945274955393,12718694999138260181,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17888 /prefetch:14
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,186334769692912054,16599413128148773740,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=17992,i,419141755969663318,8104496587196394581,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
  2⤵
  PID:7640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1328,i,7243847544364992612,1346655704862474839,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:9440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,14507006958356495848,8532414177530885740,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,13104996389182831336,10268394322765454821,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18220 /prefetch:14
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18000,i,9973119379897402074,6320503634152852713,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18104 /prefetch:14
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=17992,i,10216449822809610660,7239648106496550851,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=6140,i,5276561399576762452,12717577267390679418,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=18104 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=3876,i,5281129515991615234,14489096730307867257,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:7432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,6718737345199383621,13828401492217732859,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:8744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=4888,i,12976031863383815646,12624452246700317260,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17304 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=4908,i,9276566639559899824,12898323473992534041,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:7524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=18256,i,9689419585223795059,8853419176525057860,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16876 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16932,i,7775235868845736132,49486208048332670,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16936 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16932,i,7775235868845736132,49486208048332670,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16936 /prefetch:14
  2⤵
  PID:9452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=17260,i,5562893986367512730,15366068671979472467,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17344 /prefetch:1
  2⤵
  PID:9048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=15536,i,5995422681793642938,16188205731892878479,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16840 /prefetch:1
  2⤵
  PID:7664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=16528,i,7869907412818526387,14967919790384084201,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=17080 /prefetch:1
  2⤵
  PID:7676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=17984,i,9420340050513463493,3453793930618338626,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=16640,i,9260986930401280176,2104488323782222043,2097152 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16992 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3224,i,16738340677107663770,792633959804923052,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=16960 /prefetch:14
  2⤵
  PID:9840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16724,i,7042167021586401019,4246452517123424173,524288 --field-trial-handle=2380,i,6892888797831510634,1651902299706752439,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:9260

C:\Users\Admin\Downloads\granny-legacy-v1.8.8\Granny_Legacy\Granny Legacy.exe
"C:\Users\Admin\Downloads\granny-legacy-v1.8.8\Granny_Legacy\Granny Legacy.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2648
- C:\Users\Admin\Downloads\granny-legacy-v1.8.8\Granny_Legacy\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\granny-legacy-v1.8.8\Granny_Legacy\UnityCrashHandler64.exe" --attach 2648 2794805202944
  2⤵
  PID:10172
- - C:\Users\Admin\Downloads\granny-legacy-v1.8.8\Granny_Legacy\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\granny-legacy-v1.8.8\Granny_Legacy\UnityCrashHandler64.exe" "2648" "2794805202944"
    3⤵
    PID:6288

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6464

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6300

C:\Users\Admin\Downloads\Granny _Mod Pack by Lub\Granny _Mod Pack by Lub\Granny.exe
"C:\Users\Admin\Downloads\Granny _Mod Pack by Lub\Granny _Mod Pack by Lub\Granny.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8612
- C:\Users\Admin\Downloads\Granny _Mod Pack by Lub\Granny _Mod Pack by Lub\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\Granny _Mod Pack by Lub\Granny _Mod Pack by Lub\UnityCrashHandler64.exe" --attach 8612 2524931559424
  2⤵
  PID:10020

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:8564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\LocalLow\DVloper\Granny\Unity\20d466dd-483d-4ac9-9a6f-bd439061fa46\Analytics\ArchivedEvents\178725214400002.8b775bee\g
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\DVloper\Granny\Unity\20d466dd-483d-4ac9-9a6f-bd439061fa46\Analytics\ArchivedEvents\178725214400002.8b775bee\s
Size 343B
SHA256 afbf8128ae1706ae5ae347aa755594bbfec8b3816a4eed4171bc5d4749696fbf
MD5 6fd3a82a651fb6b193e5978f11891988
SHA1 8414e336b712e2776da99ad13e79fdad0361f642
SHA512 948a6eac2b841ca0f77481ff28e50466d3615160d3939f567e95fa71cb715ebab8ac450a9f3d8ad62ccc218c3a50f72df0b3c0b5a4e7a56698973b546170361f
TLSH
T162E0C00E4B32AE38A7B8408F0876E9515E2E22B0D845D9EC543D0241029F42C571281B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

4482e3f6-ecf3-417f-b6d8-c4b314b5b7ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4482e3f6-ecf3-417f-b6d8-c4b314b5b7ff.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 52199157c597bd463ca9715c49aa4a7afea2488016ebb7736a797b27b5780f5c
MD5 24e584b8a514cce669638644fe7724e7
SHA1 6987fb30d7bd4b8cdf74f6a6da8fffb5d4bd8fa8
SHA512 41a756f403caf3e24ea5a37ffb5c2d419080e898077e31a50a8640455d073f26e9ecc7332f6768410ebf8079c6b23054241bf082e59c33c35c34c9f3438f9cb0
TLSH
T14FE07D8C44CEC2EEE600E467916CD7ACC280360FD6EAE90A3B02C4D57846040B2D2B90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3f5141d90f33a2222414910bf93d42368281e3556aba842817dba2ad437355db
MD5 dcf66ae2fa3410d2e4ef3161efde417e
SHA1 1f1f45de1a7436db457b69b7a4e0bd43ebe61592
SHA512 ac53862abe19567f296264a1a7e03b9ab0610cbb1cf5f6a352324c132b3f16195bfe6daff1599da9406215dc53a2f401b16841e1a804e70876a10c66fca257bd
TLSH
T1A5E0269404CCC3FEEB106877D2AC734CCB81360B92EAE95A670088C57446090A2C6791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 62a6adaf6646f6d856bcfbed5915a3028f976093974c86924d449e994002b6df
MD5 777e43308e6d0ca0520e97db68720ee0
SHA1 6d471db90acc547ce62fd9322785a9f4d1e202a6
SHA512 ddc032bef9fa1bdfdba92596a564f18fb95099142616f1209a1a358d3e35dd7dcfcd9696d09db8523be62e68b265f5f82395f78b7bfaa750f30089649d0dc8e2
TLSH
T1C0E07DD515CFC3AEE609A487517C631D82C2371ED7C9F94A1B24C4ACF041480B7E7791
MD5 SHA1 SHA512 TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 17KB
SHA256 fc8844496b491a95b1b4e6e841008e5ad286bc61207d0d4375a005611f289502
MD5 483d76d7b831cc2461e5ef984343823e
SHA1 a650a681e73b3f5a76fce5f25e149b019d08ea59
SHA512 4c248473ab917254777bdc7212df485812b1270bc0ee44bf72ce456bc7fcfbd031c91b173a4e2c531994a0543c17967eaa64d6aa40f626e1d789c8d4a409d6ae
SSDEEP 384:yFU/N7/cGz44d8sJEzqE1vmD2SgChUVkG5+ICSaiLUG0:yFQl/cE44GZqKvmDp8KBkoh
TLSH
T16D82D0693963E08FC17C485A93F503640AA9FBE2EF4746898A5D20D21D0B1E14BA5FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 56KB
SHA256 a0e5492c1c9be67063194b01b9824f8ebad83a069bf3819f29fa39195cf980ea
MD5 6067d73677ba41f7d1da4ab20f197f5c
SHA1 88cbc4e1f8924f19aca51c1df409394ddd471201
SHA512 abc69bc3063699f714ff71858ea668c5499f631fdf8c89540aa52c58046b079a0cac13848bb7409b089132b088986bdeaefeb8f90764a4cbb25d7aea1ea76d8d
SSDEEP 1536:A/l7ksnWwrZaEjnGjVwaE3zc4o3k3Ki/y3aG4j:AhkbwBIVwa8ow/yqG4j
TLSH
T1464301159D5CDAD8DFBF6E90F6C15002621714D9339299638E8E3BBD00B6D87C83919F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 47KB
SHA256 4e8ea7f64c5c2bceb4e5ebc7644e27c3573b8c3ae330fab388ebf5f1126b1d3e
MD5 80b2d131e4fe560174e84cdc1748cc33
SHA1 35eb9b7338cfd2fd24a95b860e8d4a916b87bb30
SHA512 74d7f8cfc2e7359b2acf0b0af732e33aa68fc6772074611aff972341cdae21e5d5cddb7029646ff238e7c2ddd675ecc4a529e56d28d61de48ae86e91f0ea0ddd
SSDEEP 768:ps6vosge1DlRtH9vDc+zAdRG/r/BmRpoyUE/FP/f+2mt9vxoxHAjkLYiOL8PZXaS:pXvoxezRN9vA+kdg70RpRztf+2mtxx45
TLSH
T1DD23015025DF9A44A6F0BE23EFB40AA40A20A907DEB5115BC7C705FBB071BD1AD37936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 256KB
SHA256 dc1c6406f697b169763b4d2c9d04f9a085d983ded648dee6a7b9b0fc8f384c76
MD5 cd110eac717cf170ac3577e0688abfaa
SHA1 fd0d805961eb495bcba9d4b13ce66f6849be486f
SHA512 9d976d933ead9dffca80cb4557120fd0d986025ec874b52fda18a99ecd090fb99c698947aab62b7b18c8cd7a0d743fe39407457a32c39bfddba4399b532d6711
SSDEEP 6144:jrSg9Zl4ouaEN26aQiAPZf1f4KOlP+lIwx:jGZouaX6JPj3kP+lIw
TLSH
T13444E1B4F683C781EF4376F4F0AC2DA30F6606CA61E3591B49613D11A905AB5E31FA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 512KB
SHA256 2ce14807456d9567337ed7cef963905cb0267568af3a4435fcd075005da39eff
MD5 17fd754bd728e9dd2c1049caa865062c
SHA1 5b90defc04d8fb1637fc47c324afc16adff23cda
SHA512 533888eae9b030798bcf9ac67667e6b33469f24b023846efde6a773838b131f262602f555969f2d38802d1182a34d74734fad327a0a13c56ccb851c0d301a36e
SSDEEP 6144:jtKfPCQIXMD8ARnTGCkggHtc8NYJRNna/vP0CSc:2PCQ3HTFk1N2NWP
TLSH
T1E7B41235F6C38780DB1366B9B07D3E960F5606CA25E6979F27337C41B881225FA2B50D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 17KB
SHA256 6e06dc8c1cd97d04e6295968eaf0408082e0c9ca4e7b6eec1d1c5766f95b1cf3
MD5 53afcd7e089679643f25eae497ac6d3f
SHA1 e2307f4359cc17cbb6aa983e4e0e768745fb1a12
SHA512 99440d3d426eb3f4bea39452782c1155206f7664b6e346d90a73ed9419d2d597156f70276c06fc1edba98d73de5b9ab47442c40c9df4f9dddc5e8284e3160e72
SSDEEP 384:kqFUlfAU7x/RlltmpRJmGKmbCusb3XFn1EcoDDxp0VUPmQcY:2hmpR/p4F1EcoPxp0VSt
TLSH
T1C182D0E51834A08A489DCB54E9595F4CB93CEB2DCEC27A1A1C1DD88306EFA5032F215A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 19KB
SHA256 a6ad466db1c89fb28591e14d7d1efdb8faa1f105801b9818ebf58e4820366db5
MD5 df5ffccca66a7e27cfe1ca15ddff8125
SHA1 c6a3d33ae5700a9ee2575de63dc5f7750a507790
SHA512 dffeeb40daa00fb835da95e6bf8d336cd74466dfdc84e5b44b6f160714e8aa35e3465c5c53bb2f7b94be775547496dc4db251ec9155b52eda447546275e3d1e1
SSDEEP 384:MjMABaK+zFDMKAeb0rxpirVFGpilIQN2m/mOeaTTLMOIOCwQNu/:9ABV+zFYa0rCX4MukTsvwQNu/
TLSH
T18D92E059702EEE01B8BB4F95607F0E1E9ADD69F5036EA13C5EB6074FD0F8815F160884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 32KB
SHA256 28361d62b2d9a3463c772b80c9c7c2f9292542fd1ef46e5ff2cef50f0779d080
MD5 413a0f9ad69172a8909cd491d7ab6de7
SHA1 a62abb34698bbb335e35908f12876ab151515347
SHA512 4501a2d3d43a8f4b4e8a960666e60347b92a7b25ac9d29a3c8b02aad91a8eb372865d2ae6e6b1150206634101e61937db284f05c071499af7d4fc86cd056c9b4
SSDEEP 768:30lxLWyhcPmeA5GfntprmpoO9u5tbl1PZ1jSRMFyJ:3IxLWyh6AOGoO9+tbl1PZ9SUy
TLSH
T131E2F1413CB92FBBCA8C452451816C10FFCB1FC838667905663DE4ED9E6B5F2BA6086C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 18KB
SHA256 64bfb25552549440871c3462f7ca9143c13859ec6aba37a16a40986951f95ea4
MD5 532960a48886deffd9e254abd690f165
SHA1 53634f7f51661b2b7623207ee7fc4ad2224eaa27
SHA512 8724c3d6104de020ae6ac71ce16a05e3663aed95a3d06b50dfc37943d26279d18ebfff69616c85bd53a385c4aa36ae85e5cd37ffa5b4ea4d5c2c2d04e1eb7d0d
SSDEEP 384:s5igNB1IbZfTMKVOqRSI9IVvs6XxLtiYIn6+dQKY8:s5ii+fTMKkqYxs6XxLMPn15
TLSH
T1E682E1EDD6E9F324267152C1DB8D64126BF80F4AB25322C8FA99C16E07E91C64D0FD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 39KB
SHA256 28bc2090a696abac3f58b64052819146d487884bf63dfaa5b15c95a948e2b6d6
MD5 730c2d34c1758691b03f81479c4f8d97
SHA1 1353462d20e4eb282f6f7ac40ecf91628b1ceaf7
SHA512 a07e73c6cce577aa5be5ed0a307c6ec118acea5969bb0971799ba062b31bf01f5d1fdc2fa6299b86d4a1a3f96482f374280c3daa57cbc8763038348e7cd23455
SSDEEP 768:Dxjx1Coy6lWaLRB1FDdSEbmIovkJPx6CnE8H8lgDUTo/yX+Jy43:Dxz87SHCPFvOXHYgCo/yXRM
TLSH
T10D03F12CECB27134442817E581EAEFD9560EC6A7FA452041ACDBE741E0999D2D78FCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e8
Size 204KB
SHA256 1695e9d5564b8d62525e01e924b3b78d72255b52200b6e36102cb116da0d72ac
MD5 0835172e62587a36af6f78edd7fc9357
SHA1 e2e3c1978dafaeef7e9684087085e242a206b5d4
SHA512 738e9393b1d59a1548db8c305ce82982c6eb7a78976455f57ced21f40ad3e96322e3488595101c40354036bc21b495b141c7e4a7a5c285ce0a96ccdb6fb3e5e4
SSDEEP 6144:7iKVNpeP9T+UxLYqw0Fy9Tu8PsRggHmqjBYd:TVzeP9T5Fi9O9HmqGd
TLSH
T1332413AC75D221B597ABE455308BF81C9A8C25F954E0529DBDBEE35082CBD3308724FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 11KB
SHA256 54882e1239f6ed19f09a8859f228275d40bfed072b62614cb57792d2c85590ae
MD5 287bc881fda2004476f5ffe750b75064
SHA1 c109f870f0bbb0deaa713a2fa3dd45abbaffb238
SHA512 73a5ec9c987093ba55cd5606799049f1b75088d15e7497c9bff704a5502a5e9a640d1f10fdfb7d64d8c96827278927b40c342e840d86afa2fe061c563599a737
SSDEEP 192:E/Ei7oeAbd0oJkSDDL7Mme4LxLJA7wgod5Z95S4s0gvr+8o0gulaTD/ltGgjnyxM:3n1bl2ao7E9P6zVh88w
TLSH
T1B0321E5295ADB8A8D7C4FD701ADDA8E23EF4C0C3040B7E1E6994BE78154EF5126C932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 79abbe370563f98ad13ca31b65ef4096449862867daeccbe9e8e9ab4ba0064d7
MD5 1a2a156f88aeceb1113dd8c62014daad
SHA1 aa4925335df0d54a8a86a2322ae07dc24302f77c
SHA512 2630b1b20fe77b2c5538c4e07095a7cc4926f524d74d844080d19b7e3b7443b3049df2bd086e87254c1a66c66d6665f6e06bbb993d8958b0e4a84d8e70040e9a
SSDEEP 192:Z35Koi2pKDlP0Z6igVWtVtUTEZGuickmBfoSqTWjnzMMuJzSLJ86SWuBz50eBJts:LCYdGoaweEFWnhkXB
TLSH
T1392289558DADB8A8DBC0BD7059DC6CE739B5C0C3094B7E1E5868BD75114EF4126C832B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 78693db2e460a05181aa6cc1c55fce5c72cb9f93f196a46a128e449e07e18cdc
MD5 e0c2c3523cdfdcd1a202cbee630b20a7
SHA1 9709bef381fc61f7ea8e31743a7be013ffcf5771
SHA512 665b9dd4bf0b4916402f697d9af91adfac28caeaff7af083d05fc00d533a8264e64819c47dbbe217ab1eb38338b848a182aad09a673b0e450a99e740945387c0
SSDEEP 48:DZS1X0kMtpe0l5hDjBcx68Ub5ngKrdLZRROS1ZTe7Y0JvxtFLZWhw9DEjtaTG:Mx0kMDlb9IEqUd8Srm3Jvxbt+8EsC
TLSH
T155917896CED99499CB20FAB196910C3F22F450D51D4EBF2F60BC3D692686F8219D803F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 c1ee0b56cbd1e39276243e76157c8edb71048c7fb9144e5c4d11e0840c163ca8
MD5 2ef33e0af667d10a923ae3560e9ae55b
SHA1 a25a3206db29f7faa7a91f391798c944a1c4bc7c
SHA512 80835b780b6db92216dbbc049c4074835a9ac1765a02fe9e77101181514ab3cd4a58cf7a82bbf9c3dc038f5a657d92d10e0b20957b72c82757f693f0d3c30a29
SSDEEP 192:iZCEi7oRwCfF0JkUrx7Mjg4CxgJWOwVod5a5HCi0gv88fofwlaTL8ltGgjnOxZnW:qJg7wgitEJX0U2h7VY
TLSH
T16222EA5299ADB8ECE780FCB119DC68E23EB4C0C7050B7E1E6858BD78554DF4226C9727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 397a6c0753c342e64f129c1cbcb7d885d11196523ebb9c7a7f0fb0ee35823347
MD5 e3b2a4ddbf513db39f23713447245301
SHA1 14da9c88b6e5c477c0a33b6833fe5babb27a6a87
SHA512 e5b1f1b81e5d6adbac2ec997d9f0ba1ad2d87eaed9961520149f58d60e8e98bb1f6ee644f48aa744183baf56bb84bc86af2caef94b15aec24aa75f93052fa07f
SSDEEP 192:CxhEi7oRACjF0JkUrx7MjgsCxgJWOwVod5a5HCi0gv88fofwlaTL8ltGgjnOxZnZ:CYpg7wgitEJX0U2h7Vz
TLSH
T18422EA5299ADB8ECE780FDB119DC68E23EB4C0C7050B7E1D6858BD78554EF422AC4727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 d72dc8155b3aefb1cc865073559ea7796a0bce3aca111f725f2c311a7649ca71
MD5 af7c2eb74846065850eb7f4c4d61a921
SHA1 a584cc9a07abe3390805e8d37821e4485021ed03
SHA512 c7ea0d20497ca0c774d3f38d5f9bd731d7f5a16e0d056ae3ed8d495ffa320ada4666e679f547a16b367c0313aba4a57a80ee991ee86477be67c88c4ad6b9c82b
SSDEEP 192:7/Ei7ovAbdvoJkSD0L7MBe4TxLJA7wgod5r5S4d0gvr+8o0gulaTL8ltGgjnOxZJ:A5tbljit4E9a67VhP8o
TLSH
T193320C5295ADB8A8E7C4FD7019DD68E23EB4C0C3050B7E1E6988BE78154EF4126C932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4d393ed0983f3d786e35ad65821c98788f0f98db421045425d43cce30a74aad7
MD5 148e2730ef487dc44d3148ac9d86bf69
SHA1 e647eeba2d885c450955d6f17cfa0c9f179afc54
SHA512 80c779a943a179e3235cf6fc3e41459cd4a2ef53d61c5121c38c07891e2889f32935ac6196df03e819cb6b078a380ee092d5964b0bcd704ab760503a24231671
SSDEEP 48:IZS1CfkMCpe0l5hDjBcx6HPb5ngKYLZRPrS1yar8Y4JFxtFrZXhX9DE/CbzY:BsfkM4lb9I6qj7SEPTJFxbNxVEWY
TLSH
T118914596CED99499CF14FAB192910C3B22F450D15D4EBF2F60BC3D6A1687F8219D803B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b2b43.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b2b43.TMP
Size 2KB
SHA256 2417342a18085998597f2fa4a99aba0b0f00fa41478177372d559fa0228500ef
MD5 b23dcd5c69b9abc155282f3984685319
SHA1 a90bcfd7acf938cc616dd405b441e5961af1ea61
SHA512 eeb8ccdc9b892f8c007d985603be7c2f9e736f5e2e7cc8fcd62e9f448462d676c9d035d6f23a0f6ecd3b3592505150f4dd4c5d687bb79dac6222138cfbef4416
TLSH
T105513E97C3E689A9C764E5F263E108B932F19092014FEB12B07D3EBC5A86F0511DC43B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 4ef467eee41442ebb9203c041cb6e17b61659324ff1400268e9e7b748d5ff1a6
MD5 28150c7af531709bafc17f3239c7f5e6
SHA1 5f6c4eec7ca7e8cb05832f37218922f851987f61
SHA512 3c095ed16d523b50aaeab3d9b2ab5f9e68cb870cd4275e993aa354f0798be7f0ae36fb4e201128000e0b630a9c8588a816494f589d2a322e676d71aaf938270e
SSDEEP 768:JuCYeAPdyaXao4HBM82x72YkMRMA0iYYMBF:hAiMZx6EMBF
TLSH
T140D26762B5F9020AF2B75F7BE8B617954CBABE462D04D81E5861620D4C72F40CD73B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 ccb44956b6f7843d56cef7df1ed28c340624d11d8e40f063e7c99b26f4796a7d
MD5 87aaf653cf6da91c945bb591c380f835
SHA1 86c90fabf965bbfbdf24ab2891aebad7ad399db2
SHA512 b7673ef80abdd3bdb6779220c1ca37b93b958fc8a65df503ac24a3829ee7d07ae0cc71cc4d9ceadf4695267cef0d811c55e79b0de476201e78e6c96f9747e64d
SSDEEP 384:DBLikcGVz+HUEgte6PDVeDKTgSNebUPVrBeuoR0HyOo63r/wyWFaZxwIIikjnqK2:uy0JQTLIav
TLSH
T144D26BF7C7B47B3D9D31A9F06A1A2E1FCE190821675C782A85D45F1683E2422E006F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5c6c2021a39b48df7ed6baf6872315b76e45319c008cb029125c1bebd818fb76
MD5 0e3e823205bd74d0df8fbaa09cb8e15b
SHA1 46513ed9dbad6e868d39e4f82d672e4cc48b2da9
SHA512 797f2efa4450c458d873edf4ef1598451b0f77b995d0b995eb644bccea07cdd92f0be21b5dece1b996fcff692fbb6ffe94c0e0b7779e818666ba2a570960f781
TLSH
T18D81ABF7C3E5862EC91195F0AA146F1BCF1C0452436C3D5A89E4AF1BA3F28B1E151A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 33KB
SHA256 034b0b10c4ab5bfde28e87cd600c3da63ad48ea157630baa4858c453cd24ec9f
MD5 3ca617985fbeedd34da1b606e37394ea
SHA1 45cfab7f0e9554e5bf823530357c0042e070c6c4
SHA512 06671570fa40ce4d3d9eb6d92dc1b7398294d4d97ffca7c48cd5b3fa149113b5b890fdeb3d410b8bd54ef6eeb4d446aba3401751df36e045e08addd0fdcf3e0c
SSDEEP 384:DqEE7jGwUy7kZgveocmLsSekM9keybOj8BeFFiMvpauIZaZxwI17MitTybGkii+r:bCfn8yM2rsV
TLSH
T1B5F27CF7C7F86F3D8D31A9F06A1A2E1FCE190C15671C782A89D55F1A93E2431D102A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 5c2512e360981e88f82007200deaedbc88ee61965e4eea4c0d31ad37fdea27c4
MD5 feea47ab2af7c46b0b29f2a5a8e27149
SHA1 6b258e69e46ceee26a016afe3731503aa85dde22
SHA512 270dd1589303bdd31cbb66b27d7941a614e8852ad742b04ad7ec33d469850764f01f39a8bb348dccc8597a90114169fc49e72298b850e21453317c7f19cd8690
SSDEEP 384:DBLicGVz+HUEgte6PDVeDKTgSNebUPVrBeuoR0HyOo63r/wyW1xaZxwIIikjnqKP:VyAJQTLIo7g
TLSH
T122D27CF7C7B47B3D9D31A9F06A1A2E1FCE190825675C782A85D45F1683E2432E006E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 34KB
SHA256 e92111193804576f37224a17009b2a5b9a3199eaefe653a4984c9873921b2b62
MD5 7ac4d5c59eda597fdd243a4beed0b9e0
SHA1 463c9347f32c8227096ceb188adc9dc2d1a4c518
SHA512 f09b3d2ed1171b60f7017e669fca89903e25a0a4b907fef7999d546a2054e9f097e50bca8b261151533e1932b7c318c2046bf19a56fed979844c47af7e431347
SSDEEP 384:DcGVz+HUEgte6PDVeDKTgSNebUPVrBeuoR0HyOo63r/wyW1pdVzjox6Ye6Ojuj69:gy7JQTLIS4j2
TLSH
T13EF28CF7C3B46B3D8D31A9F06A1A2E1FCE190815575C782A89D45F1AD3E2432E142E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e03bd2d41cdf511df12cf717d694402490b6d9704ee0aae81972e143dc391f43
MD5 a4990d652ceb48ec996d0fb16af2b46b
SHA1 6df284f8a12d594300ab8f34ceb6a3cb22ac9451
SHA512 da676f4c4421379b4e89061702e7f583c60f313fec1210474d20117e2b87e0e9e44b4c85a8661182224a2ad166795e81d60be055a448d9df0f855d384c7e76f1
TLSH
T182D022233680B0B7EAECBEC180AAEC8FC33660600C02DFD560E0AC9C053346D951B282
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 d05bf8757d7cee0bf9f3ebeb698916a65b838c2be6d7ee13a4ed1bdafaa28c13
MD5 cb52dd710114ebd7a4d5866354f00424
SHA1 5fc3d3ef72fd5bd879cf89d0178a25646521a897
SHA512 b8c85da87762e0feb398e0d819902b579db5ff2da008903bcfcf413869ef0269741e3507c293e4597ccdb551e62256ddae49c05f2bbc8a5a1728b4714f375f2a
TLSH
T165D022AB2A8031B5FADCBED680BAEC8EC33620684C069ED420E06C9C153386D050B182
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 46KB
SHA256 e5aec44221793133c0f5418f79d4b6683971b1e9cc996147e602633a45f20a93
MD5 890cacce62cfbadafba24bf52a707863
SHA1 27f8cfd286cc35b07def8730932af399f769d550
SHA512 5d79ed40757137467c9beb8f832df8259588f6c6fabe1e3bbc6809a5327f345abba6946f7afff73d1827240b3f870120592a2b990d43770ceb68bad6d2b0d76f
SSDEEP 768:sopym49/fL54Mnc7WeT+30o/5UxmAnm16CKp3C:bym45aMmW90eUASmjKp3C
TLSH
T177237593A120C96A46D76C35F839FE3BD788045699D4CEDB6ED8C81C00DB5FDAA21C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 2a832d80a7a7c7ccb2eb21839b9a9bed2fb7244f60acd63d3aed096949084d98
MD5 0b5ddb80261a6aa00eede6dd73a174e3
SHA1 e18787fe557f87cc764b9841655848f47dd4cf09
SHA512 e784afc767ee615c70c25bf4ca52a02a3f3139d0707605a9f04d8dd8d9b3b989f3a6c68043f24d19ec6ff79efbcefce6e0fa08369c191b162b140cae31aed15c
SSDEEP 384:sxRXvm19/fMsLQwlzurlpqfy/5EU/9R65Er0ym80j:s7vm19/fLQT/5fr6Coyqj
TLSH
T13192C6536524C87B8CCBDA19BD35BF16D7E814229C815E8CAAFCC91C04DF6FD2626817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e1673f52da12c89327ee48a241da4064eb03fcc148f68c6a400722d8d5cdf6ba
MD5 4e0f3a6555bd2fd6807f35500d3f1746
SHA1 ac2d2b3528337374f1175dfb3216b75f65c84b62
SHA512 01873c1a4de30ee0d577278a4017e289eac63624fcb3def58578a41fa1a52f5e10a8c06416a78198a6a1677155823bf4e26247e2c488bb43a6571f69bc981cf2
SSDEEP 192:sxRcR1GO9/fMsxCNGZltObLpVoA8pJ73/g6+WNP8IN/YbjDZ6VGAIgVTL0pJ:sxRcuO9/fMsQNwleul3/50a/W65iT
TLSH
T1F752E8166928593B9CC7E25DFA15BF53D3FC2032A4D45A48E6FC9A1C08EB7DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 15c041b15feb1bbe739ceeaa74f5a08f08b53f9e5d9a833b3b29a50fd36a36c5
MD5 3e3acd97f73f82e47b36f07494ac3098
SHA1 1a5e4683b23a41be6a555fe87ad9f409b456581d
SHA512 713e4819e117188a194e397331e94a3711490bd2c4f9c79e5f7c0437d7ebdc9194bf6f29231b3c3b7bad0f7d60f230373386fd87bba2f3b16df8852d6309d850
SSDEEP 384:sxRXvm49/fMsLQwlzurlpqfy/5K/U/0BzkGaORma465Er0ym80j:s7vm49/fLQT/5z0m/Kmd6Coyqj
TLSH
T1A3D23493A1345ABA4ADA6835F834FF3ED7950456DCD48EC6AEECC82C00DB5FD6421C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 48f682de44ad68df725677b9438dced708de7635ff183a7434f848e75be5e4c0
MD5 79ce00126d2f4cb3077eff34618b718f
SHA1 42ae9c21451d626fe5f4ed9a66220d865c3fa462
SHA512 fbc8f5a6ae24a5bfb0e627b9669bc1aeab6e73474576a8887d93940a97b84a3dd1d8914269e4633d14ad3cf65d3dcc97e56a4593c72ecbee9aafcd3024c6ac30
SSDEEP 192:sxRXR1GO9/fMs4CQGZltObLpVoA8pJ73/g6+WNP8IN/YbuIZ6VGAIgDLTL0pJ:sxRXuO9/fMsLQwleul3/50a/e65ET
TLSH
T1A152D716A928593B9CC7E61DFA16BF53E3FC1032A5D45A48E6FC9A1C04E77CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 892e11f78fede25b2224040efdb6444fc3ccde52f003b01c60d123ccff8cdd6f
MD5 a121a8c36c5cb7ca5e27031e328b3115
SHA1 b38ab9c9efba21d89eeefb60f26be216bde69702
SHA512 c0abd6a81ae4eeffa69062efa3d0abee4521e38bbc7b7f4705ce97caa63f6ed35d6b80f2538bdeef41de854110c45443d094e9c69db7c429292d9ece9c6c155e
SSDEEP 384:sxRXu2m49/fMsLQwllurSfy/5Wb8fxBzktaORmaj65Er0ym80j:s7Fm49/fLQ1/5XxmEKmc6Coyqj
TLSH
T111D23493A1345ABA4ADA6836F834FF3ED7950456DCD48EC6AEECC81C00DB5FD6421C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 46KB
SHA256 1432477c0514034d1cb35b340c4bec2f8c3ce7e568e3304aa9de88eb87d8e764
MD5 8f4b79341466c203f9ac2040823a06f8
SHA1 fcaeedfad748557cc7072cde2dd8b6de05fc7a6d
SHA512 c22f8099897950bb3efbf1448baad6b641bcc21661a90f3e68e1b17b14b09f999b4b56feab1cc1ab4bbb09248024aab93f94eb75d42de6cdf09de0f323a8dda3
SSDEEP 768:sopvm49/fL54Mnc7WeT+3ja/5qxmGnmO6CKp3C:bvm45aMmW9jUqAImgKp3C
TLSH
T1E1238693A120C96A46D76C35F838FE3BD78804569DD4CEDB6ED8C81C00DB5FDAA21C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 45KB
SHA256 74311d5edb2ba3afbd300855497142c832a14a341a8fbf8ee6e0bfe0b258f1a4
MD5 e5888d5e5b893b8ad6d656acd3519a32
SHA1 c5088608dc7cdf7e1d4a631713e2d4bd418ec19e
SHA512 9a8336fe953c46839f563121f7032dd32608a5781014792d2c0ce53249845f28db30cf3be252a4527a9354ac7862254c4bafba30838bc21255d7dfdaa633e6e9
SSDEEP 768:slvm49/fL54Mnc7WeT+38uF/5RxmGnme6CAy3C:Ovm45aMmW98CRAImwAy3C
TLSH
T170237693A124C96A46D76C35F83CFE3AD788045699D4CEDB6EECC81C00DB5FDAA21C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 44KB
SHA256 5689a5e1b21607c39311aee5040f83ad4530a1044441147b5f8cfc885ca00cb1
MD5 d4e5370f2da1aaa63d0868ed8998e460
SHA1 a9c479024dc128bb0bc1b5d7f1c5d396274773cd
SHA512 de1e62378b4e694c95e94b445bbde064a03b020672bfa13a47d87f57d0a708e6a4f76407e2939108380a743742b52340caad4b11ad7c5691b96d345c503d29fd
SSDEEP 768:s7vm49/fL54Mnc7WeT+3Y1F/5XxmunmK6Coypj:Yvm45aMmW9YhXAwmMoypj
TLSH
T139237693A124C96A46D76C35F83CFE3AD788045699D4CEDB6ED8C81C00DF5FDAA21C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d9c51e1f077eb0e1918a3af69750954111164d939233d108898605dee94e963c
MD5 a848f82424f419fd4ea86aee2903e227
SHA1 0126e99d52b1434b66e65c0c52bfee257d088d56
SHA512 385db0c0e857c76a6956f2e7640ba8a8327f6a116751a3f629a63f01029215e73e6c5f75b00cb4d96d0d7bf8084961840e9c19ef6e66bc2a589f3bedd79af871
SSDEEP 192:sxRXR1GO9/fMs4CNGZltObLpVoA8pJ73/g6+WNP8IN/YbjyZ6VGAIgDhTL0pJ:sxRXuO9/fMsLNwleul3/50a/N65ST
TLSH
T19452E816A928593B8CC7E21DFA15BF53D3FC1032A5D45A48E6FC9A1C08E77DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e459ec8b5f16b3c0d685ec01ee2bb466da9b91d2908ee348207338a0a5fbafe5
MD5 a37fecfb599b82ef7a165f360f7b2db0
SHA1 cd96c09c6dd0e82e1684ce950dc9f4cdb5d160e9
SHA512 431b3989476f24800da6697dbe59e82cd889c0babe01a80ea27b6bc9256e16929fa0438bcd390d4cb3b83b882e543ce3c7350293932f53e62016c9e4fec8cf45
SSDEEP 768:Fb1pZ67pLuLz2tWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVCPpJ8IfroSwvh:Fb1pZSEz2tWgikfq4u1jaVPpyIMD
TLSH
T1ACD2DA7B240DCB7F4F804ADDEC197A9B6DA802CB96D8CD8447FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\69ac1895-b9c6-4383-b9a1-c7b8624944f1\index-dir\the-real-index
Size 72B
SHA256 fb7e5cfdfef011235acade15968e9d1123343748ba303f2a914bd1b8962f119a
MD5 54c10c543d685438121282af31cfdb71
SHA1 721abd63ead86dd6275e135403a777c2a76c49e5
SHA512 f9096e2b1db596fcb42f7de7ab0139012b64eb326df27971c7fa9508066405fd747517a041f798bf962d292e2a7bf153f6ccd72815a2820c7af7f19433f23630
TLSH
T154A002158D58C055E05957FA116706F9322A59DC0B06164586F800F58CB0E9443931C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\69ac1895-b9c6-4383-b9a1-c7b8624944f1\index-dir\the-real-index
Size 72B
SHA256 45d9b3fb42324387e1bede9d80980dedaa33bfefe6f28984a303e5fc3f309028
MD5 842e05e43b067d9e1624b76fc55afc93
SHA1 bbaeedd17bab81ffc0ac23e7436d4d70aeedee37
SHA512 b1528c8d4f7bd804cbc6c96a1b3dbb0a1ab66b44820c63c75c4125b23d88960cde3a8d76d6905990a29bb0cecb9f8da220ee0b2f4609896b3e2b226902daac16
TLSH
T177A00216155D0489C008937257471594222649552DA6075A86A4A275CAE06D84111180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da933.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\69ac1895-b9c6-4383-b9a1-c7b8624944f1\index-dir\the-real-index~RFe5da933.TMP
Size 48B
SHA256 96a4669eae3c000bedc8140089106a3fd4bbe85f7ec36606d3067fc7c19a8d06
MD5 bc4454017d73e4024de0add3a0d834c7
SHA1 ca820bde8ce60cae6a6741d57f50244c90c83c78
SHA512 891c3ef377266628ffdc69269bf1f9a048d77afb349a67662ab6697705b59377055a14986896dfc7fab5ae9d2d2bf8f1a8ab642836e6e21e972775af1570e22c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\77a4afab-6748-42a0-94be-9e1dc7dc6818\index-dir\temp-index
Size 3KB
SHA256 ccbf34a2894edecee46b72a48161b1a46a85da6797c9d685f125d2d128347e41
MD5 f4a17484ba42eff6d10e6e40ba0fa481
SHA1 e4bf40ba19a7b4179d7902655b05a07c5fd19491
SHA512 82e3c3c478dfd05401233f68efc341625579990985162ddd2179c5b9855edede9ef43fdf87a0d6413c48438b6e744ae7bd4e1dbe1de0ebd0249b72259ee90a66
TLSH
T1C451C74E8C8E0F9FD96D11B298F60411377465EE17B85E07189C9274BDC332F1D48A5A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\77a4afab-6748-42a0-94be-9e1dc7dc6818\index-dir\the-real-index
Size 144B
SHA256 a6c1d6c46ee5e8d06e1ce9432399bcdada4b39461beec77fe114edc04f7693e1
MD5 c6b730e633566e8ddea7042b3389c978
SHA1 062a946b47c47db81607ffa231b98485b91ae1cd
SHA512 0d5f6897e17052825831f2e6d3ef1e6868f2e49462593e4ca0071aeadd94e90431fd14b90825cea6ebb4e0e0054d9a7b05b8ab017c5c4a49e03e9edd96db93a8
TLSH
T1C5C09201CE6A4565C8066932216B206826720AAD09676E5A14EC5806A572859D0CBC19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad15b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\77a4afab-6748-42a0-94be-9e1dc7dc6818\index-dir\the-real-index~RFe5ad15b.TMP
Size 144B
SHA256 8a7c91c697f362c3ed1e5491f5bb2689f9f4667d2dcc333aedb3b5dd52324e4e
MD5 573957d83af66f626621543a1dafc47d
SHA1 27dea10499b80f9e14eb089153d941f80da08019
SHA512 1b995106a1c8cfac6832cd63f7e45e44d048485476b1a0b27365f2aeccdb1b8d0c9c735a9e313154d3927be310c24e48aec7338e5043184e73eb79f031e4ee75
TLSH
T121C01212C96688B0C40B95701043835822AB5C340426F6AB60FD4C6F58B18C8D0CBD08
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7872f08a-b673-46b0-9314-8d2830b30fcb\4f2277ea2139c475_0
Size 81KB
SHA256 fed3ea1d55b35773f8e3f0899752cfeb045e205211ff5404968576eb40411545
MD5 dce6c14f6c4f7ad689eb7356f9f4f72a
SHA1 ee311489b1663bf389eacbf4eef6cb2b8a0ef5c9
SHA512 7dff6077c9881d847e0f5402315441abe77040f54f67ac752c909e66c2fa01ab93dcd681b69079f721abda4f4f36f4c17694b4a71b68f42c4b616b44df053b2c
SSDEEP 1536:cDQVeD++HqsJ00izhh2VMGz4XLHAyOAqUO4P2CsXEoTr5hgSf1ae4qHPwqYzG3/m:cE8+nKrVMGzALgyOpY2d/Kc/m
TLSH
T161834BA6B2527035C7AD12D594567B01F22B17961444C8FCF0BC66863F28E8B53B7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7872f08a-b673-46b0-9314-8d2830b30fcb\index-dir\the-real-index
Size 72B
SHA256 88361d244d800d84dc220573c21f9a9d1dd257d6d0fd74788155442562c7a49f
MD5 5750feae9adbde914fe5d248cecb6de0
SHA1 7db17f0fef00d982e344748a4be18a6892901be2
SHA512 12ccc393a007bd90d0bc2ce988729bd80ee9ef98bb71c41a9013b380846e098eaa4b585cfc89147e68d4e1598ae6748a199c771ad36f39403518639b764f2c8b
TLSH
T1D3A0026201E40999D5149BF0654245782317FE53210B5B1754A048559D5926D5F31040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7872f08a-b673-46b0-9314-8d2830b30fcb\index-dir\the-real-index
Size 72B
SHA256 c2fa51d723157653ac263d1ac76c0d24e88eee27e81b7d0e0fcf071c5f152f32
MD5 edfcb4973292fc61e1d8e18771617203
SHA1 8073594730957634024824740499c5751b236951
SHA512 035e28ec5aa22eee68c8974125e1a6aa6dbbfb6430ef726737a726347aaab95a556bca3c2baa8c4528afa3abecb44ceb0d8451764080b9a477b36b9c734b5a00
TLSH
T1DFA002220658024DD00196F1528641B02326FD670101470741905599CCD55D84F230D8
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\87c45525-b4e4-470c-965b-cba36d822722\623cd082b6202da0_0
Size 81KB
SHA256 287132663df118fb4d9b8bd5a87ed95289d09358f49e9be70e995b47d8b00542
MD5 bd0d651146b978f0ccaaab2010fdd38d
SHA1 fac5ec129d0ea7c048c78653e02ee929aea0fcf8
SHA512 bba83c40b35c746bfce814970538801d5795b80216aa764d8095cf00450f689a512721957654be7cf66853972dfd785f0e4ce1be00b46b793b3f710e878a49f7
SSDEEP 1536:/qV6c++HqsJ00izhh2VMGz4XLHAyOAqUO4P2CsXEoTrs8Dt0iaD/qHPwqYzGy/s:ir+nKrVMGzALgyOpY2d/2V/s
TLSH
T1AE835BA6B262703587AC11D594567B00F21B175A1848C8FCF07DA6D63B28ECB53B7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\87c45525-b4e4-470c-965b-cba36d822722\index-dir\the-real-index
Size 72B
SHA256 43dcc61625094bed0bc922fbc8342ebd0e5806caf1bc5adf0d8663e4a4b56565
MD5 adff969cfe9cf665af9917cfb5ca773e
SHA1 392c4926f37c882e0fdc8a55adea804f8d1b5bec
SHA512 851ce3716133fd0ab6adb792326a92d2596720caddf413d5b03f2e92b42ece0dc99272b41bda27c67e6e6796d8ce6a28cc5ea6225db865f3d19f37957bab52bf
TLSH
T1E2A0021D26D00652D10672B0299E91C32754D9610603977B89E50845CC51E858DD114C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\87c45525-b4e4-470c-965b-cba36d822722\index-dir\the-real-index
Size 72B
SHA256 4bdbaf0685018e4bb2fb5bbc1c7c5f1324f86f481b59390bbd5990bf7ad8e5cb
MD5 dd1f9ff5402ad50d9b7650dcb212daf0
SHA1 51414bbfa311ced63e7afdc04f87ce06158893a9
SHA512 08000cd118a2dbeef096984f999746311d09401504ca5665bb1389fd9e59a7bdad07ddb75c3cfc5bd21f6e8c70de8dd7db73130e49005c2d3dfda5140f928abd
TLSH
T1D4A002523A90000DE093E6B826921776A353E9536292170742925044CC519448FA100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\87c45525-b4e4-470c-965b-cba36d822722\index-dir\the-real-index
Size 72B
SHA256 c5d522bda776dacda6812d0466b5631c8d45d1d9b8e8cc51a56c0c4aa85ef947
MD5 e38fb489cc621da0c643f9b8cc289cf0
SHA1 268bef891e97875e84c58b83ee7eabfd08284747
SHA512 ab950f9c5c5d7dab333e165b02297e73da38bd5bdfbd6d9b8bb7515140a9c10a9d6cb41214a1a3ed2854bdd2e31e1cda9fb5d269f596f9e4e2961dcdb61bd356
TLSH
T1AEA0021543803406C06691B32AE2026622058DD05101263A48A5405DCDD0A40859141D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e0ed9651d6b0268a3697d2671933c5fe60fa2343369b5e6a191a4b73cf512e09
MD5 e8a96de0fb2caae126343f673bda561a
SHA1 dd3490b523d868354e355d60ee04eb48268b5179
SHA512 95e18cb7d60aff2d51aedae76539aa7004e1611e094346890a01816142b7f800a108ee564613995a9c4846a15bd6143acbaf074e0a3334928fdf93c8b139c7cc
TLSH
T108E0D8F72DEA2904FD6BD3C6283298F8040175598584AD6E592AE2E350A13963C8AD26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b4d58551f2087527c1b59fe98a919acec7b6210c61be61cf2c117d938d39af42
MD5 c8b7f32729ac9b6b86f6d13d2a3a7bc5
SHA1 76febf4baee4a857fcb1224c7b828b69c86b270d
SHA512 718398d05631eed9c7a21d3a65c47a6edcef2e60ddbbe799c989b440dab35f11569a9f9698efb39fc7fcd8e83c9eb4858b6aff0b7e0e32bac66e3bb49a830f66
TLSH
T1F8F027B72EFB2900FDABD3C6243258B8540179498090EC2E2926E2A360B1359288AC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 6e39762693fadfc9dd2c3fa241dda826eb36acc5cb8a55d9675c7d9da6daefe0
MD5 f34bdfdff876835e3a0286b00ceeaa47
SHA1 28c3e67e3ea8ee6fd1a8cd731317bdecffbf2cfa
SHA512 97adc56d980de7d72397cc0b79eb6c7edf5e13984bf4c924422e7ea027d6c2d6400cd101457ff7f1e417f78bd6cdf3b25fcc225264c946e27e077e6ba3d0ba50
TLSH
T18DF027B72EFB2D00FDAB93C6643258F854013D498491AD1E2926F2A360B035A284EC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 33b26cd53ad84e15eb456f8d47d50d3a4704c93bd01d4a7ffad7ec4ea505f104
MD5 8f298f1f0c916d1dd31edd6f429ce487
SHA1 833de5a9b85f94464894e299f372fdcfa180c8e0
SHA512 44d744603a0b122d74534c29e53da57d3b869da12f8ea4f52752a93491b6f5acdda953c7d15285d4093bcabec0bd5098795458fa10e2bce7a0ca687cf9d211b3
TLSH
T163F02EB73EF72900FDEBD3D5243154B4540135489090AD2E2916E2A361B03552849C26
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 128KB
SHA256 f5bcec41028a2319f3a84ff1c8a9144ea1ab0c09a3f66fded5ce17b881529bc0
MD5 277bc12e147b18ddd7de2b9d472bab00
SHA1 ded3b847372aa706b71ba121117ae8de6ac163fa
SHA512 81c77788015ad1381ab9231837d5fb1d6cf2777eeca5c2adf53566841c40f673cbdad36bb4fcfa84bea271cb7489998715e1edacd7cf272c0b858396ba59dc42
SSDEEP 3072:C4YQ9BQxPCx1BeaeNHyPL/uBO/NTL7fL/UL/rL/JL/sL/CJGHj:C4YJlyPL/6OlTL7fL/UL/rL/JL/sL/Co
TLSH
T148D39833769D50AB0E8ABA745156B50392BC6467B8449038F214A7FC25DBFB013FEEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 226KB
SHA256 35605bd10c130ff6b075696d9f999722228034392f7731278a073e70e5bedd9c
MD5 95efbc3659b4d17a6e503e886bd264d5
SHA1 195ebda1496dbb28b1d43951b26aaacc00e24a86
SHA512 ebfb49bed90d950f42826ad953f3a1ff7958ba18be6256f9c56b506d65b0495648cf64d6c88e3ca5e528136cccacd99ed68a58219249649f7bbf4e994428d120
SSDEEP 6144:seckgsFxGgcesjw/nKtGJc1KiZ3uqtL/u63iexjoezftHvR5QAh22fL/GL/RL/V+:5TcXL/hnh22fL/GL/RL/VL/RL/4/
TLSH
T113342A22235520ABCE29B3BD1123EF5373B440097EC3D26A95919334286F7F75ADF962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1b3e400b2044aa958df176ebf50439388652d6b88cc53c01b8d8328391546e4d
MD5 5a8392d2cf92b6d0a764a12e2bb6df90
SHA1 5898003a24b9740fc83846448a2425784fea5bac
SHA512 9e771cc51c364ec24ec26c5f00113100d81dc7b8e4be66e5cb458e8585dc80fc62b549959df5f51ab61192410278e3e5d0df4b7747ccada1625491cb08e5997e
TLSH
T10FA00220CF4AE002C4352A70B16D5149B3585CD916EA17266C9898AC8EA9B8461C5161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b2855.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b2855.TMP
Size 48B
SHA256 6ef69031bdb8bc9b228e8b2ab2502fe3249e305e31d08f81944c0c8cc00832ab
MD5 0587886a60af18d71f75ef21490a966e
SHA1 55ec8ab1d351c2abbf8b479825284c4cc063a03f
SHA512 a39cb463dc21e95974b0f7cfeec854362ea3efa7054cd59c213c2f8e2ab423fca4f3aaed3631a1c66e572ec95ccbc7428fcb092782845de42079d0d2ea248953
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\448f8b89-9a6e-433f-9761-e8cd6ba72a59\index-dir\the-real-index
Size 72B
SHA256 2e4463228fe8e85fc837da05dca7c7f6decb95bad3bc266b83a1bbcf8f6d30c0
MD5 7702437e49c0738e0ffb3bad38bba3d8
SHA1 310fc725f4eacb97d9f840b62a00d029f863e8e3
SHA512 c6d4ae243bfcafc94c0df6e952de4ca27273d7cfceeea44508a1818d667ad0de6bcad5c7d0317dd7f7c15b9d8c9bcec03b92795a2612cc9db17051765e96f8b6
TLSH
T115A0022802901305CA0412703A57416132724ED0E9154BC281E031CCC895A95528323D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe634b76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\448f8b89-9a6e-433f-9761-e8cd6ba72a59\index-dir\the-real-index~RFe634b76.TMP
Size 48B
SHA256 62556116b470b5cff63640159257c558f014d07787d21339ef6bfae20b7f0d5e
MD5 3abc4a86392fec5f79100e731e006475
SHA1 abeb120e07f05f544dc292bb14b7cd41abbf4bc7
SHA512 d7ce75eb22b6816aeed332157a9f425bd296c0642992c1e68717899285a64f35d3ceda39231838a600569cbca32ecc33fb06135e7d9323368406e06b8f04f6c5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 73B
SHA256 16f2e733956a69caf3cba9a7984df8a9072d616051880ec52649d5a25de0b733
MD5 eabef125304ed56696f07d27dc0a4760
SHA1 f7b1959eaad9661d26183f0a39602128c7770501
SHA512 39ec79f7f17cc61719521fc98f8b1f25f58c611763ee56fad334f92f8d372156a636f7630dd049e7c55894d8952af5e7888725220d46d382715c693ce7c9e896
TLSH
T109A002F71804808E0F30B8E8353ABB5DE00B91DC8CC4CEF4C419B0422138AF70402994
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 154B
SHA256 aa4b745662090a294c5b42eb5dba0d1047b161f21c0eba8bb9b3b1a5369d3a5d
MD5 b503e49031a9e9d36c2e9b9963d89907
SHA1 92c35e424bc3f7a621e224bc9291bb0baa076b47
SHA512 a81a6d41c23517969562c6c43f727cc7062495d89ade5e0a674f58e8b3339afea22228b0700d2056601fce8a05c29c49b662f9af3155f540ec01ab1fc93ff73e
TLSH
T1B1C08CE30034094A0778A6D4392C360CD1078C5C4CC4CEF4840E328222789634802568
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 148B
SHA256 c686d4d3f6333b2723fbcc519feb61ebe4a9d39aa68c414af31c682b353b7db5
MD5 0cb21db0e36edddf5194ad11276435e1
SHA1 2ee5c5de17e45b5bb49d290d9c0409f20fbb6f28
SHA512 41dba20994d685aab5b336e3de6b5dd9e573bb99b8fbfd87651a27913af3536fe4863fb966208c08502054edeb4368ec238b6a93f80f242a4941293bf584dbd5
TLSH
T194C08CE30024494A1B78A6D8391C360CD107804C4CD4CDF48409218212B89720802568
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe62fb91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe62fb91.TMP
Size 157B
SHA256 1262a79ab8126fcbb5cb6000f42ed7722bc845bcb283b530136ba945f513fc2a
MD5 3817c50a83abbdd1afa5e43d0e25c9eb
SHA1 6ddb2644c26d8cd78e0dd1e402f489c3cf8e8993
SHA512 2aec579764185a72f5381bab7885e414202f14794d3577119a579890613ac6e02255e72c69bfed146809d1b0647d5f6cdf34da14391c60fee8fb14d461ccc736
TLSH
T14AC08CE78431800A1720E8D0702A368CD0239D4E8CC5CBF88E10F0D125782638001564
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5bb487.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5bb487.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 49c019d3688d7b7823c9d343c39ad50a0c7e554e757bf1d540c8a327a9e24c55
MD5 b4a47b81a9c90590745bb993397515ef
SHA1 d683fbaa03e0ec3b1f02a76bdc6eeac5d4706395
SHA512 051b5feb1a4e993cbb1f43c672df0decabe3820ee1808cbb2df6fe66b2a2a9b05aa4a9e25e3283f32b5cb4bec26654db3245654dc54bedea64a7575b238cfa57
SSDEEP 768:+g346CBqobGaN/tZu4aWADIidy8Lup+/vmdTr1FnomU:+g3ktZzaNsuVL3/o7n7U
TLSH
T115F2AF79AC56DD7798BAE344B2473B47AEF85163C4894E94C8DC1B0E04C35A92327C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b0c005df5b4fd40fc9934f931770c02d37630bac6a0d232797a51c04b8f9b626
MD5 2a124a0c91bd5ba46ab7d9354aecfb2a
SHA1 2499ad820283cc8f4959a01213e53434b3ce44f6
SHA512 189c3e69c5c57284b447872d8874f450353e71b5ac96eeeb0ec1aa2a630ac6fee56d520553c4c13e8f19e6787818e30f029adb4846bf48a29b263d231ca87c7a
SSDEEP 768:QFHY3nwggb54vaN7tZu4aWADIidy8Lup+/vmdTr1FnomU:gY3ytZzaNsuVL3/o7n7U
TLSH
T1B7037C7AEC51DE7BA8F6A385B7467A479EF451A3C48D89D4C9CC1E4900C31EE131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 449c516862af91ed87d9e7db3d2503ec150d63cd8a561b88c90cae954e04140a
MD5 95ae44c8e352e66605f587b00e708de4
SHA1 081dbba13d7d420c0a5d1b867992c93a0a2002bf
SHA512 e6fcd26222a4a1de45752dcfaff902b16daa62463aec177ba50e152d666e180cad1a81ab82373403358e2b80764b5c24a062242fd1825be270a32f01d2aa43d5
SSDEEP 768:9rv+4UNbdC3JIxBqobGaYpZu4aWADIidy8LqueVH1S1C:9bsbw3npZzaNsuVLJEH1d
TLSH
T15D03CF36E859CA739CF7A284B1877A077EF89163C6880BD488DC1B4E42DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bdcd8f6570eb0c1115e360337e29937cfb93d51eb3f7d08b57e38c9b33750d2f
MD5 1485113b94bb1a9e80d8a7089ea4c2e2
SHA1 4977a35668377f69a8df7d123c9f137a55dcf5d8
SHA512 55275f4355be1844e5ddc4979c4e0efa0a051d490a1808a01b5091b4a58b545a5049fb15882aa1b0cfb7edb435eb74b861acaf4578f742d25eb73f6cdb3cf56f
SSDEEP 768:QFWL3AwgfxkBvaNaS5Zu4aWADIidy8Lup+/vmdTr1FnomU:zL3rS5ZzaNsuVL3/o7n7U
TLSH
T14F037C7AEC55DEBBA8F6A785B3467A47DEF451A3C48C89D4C9C81E4D00C31AE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c1c6655d92d71ffdcf8cf2af40c4f810ced5db3b2588618a61ebcfda3da7d1e4
MD5 b0294a97699c16b771ca2f7118c4adb9
SHA1 f687f020fe14355bed94a7594294eeb83f59878d
SHA512 6e9fbc64eebe5a11bd0c4f3a06899e84022223b634eda44570035d522ce498d70889107e73c825137666122872b4e61c939293eceea1798ab774a8674d294914
SSDEEP 768:ug3r6CBqobGaN/tZu4aWADIidy8Lup+/vmdTr1FnomU:ug3LtZzaNsuVL3/o7n7U
TLSH
T1C5F2AF79EC56DDB798BAE344B2473B47AEF85163C4894E94C8DC1B0E04C35A92327C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dd3af0cc4905b88909f5d618163eb42f03e0ffa26fd105da32cf33a7ab69d08a
MD5 f7df55e77df45de851f8bcf8068234e9
SHA1 409446496de5f2028aff21be212249f215a7db06
SHA512 08e053e57848e215a9839d61ad579d92b138f8d2145b813a0c61835a5da6e003c0ef6dcc43c7476e9cfaca044b482c0ef0b10eaa4a20a0cdcd4b2cf12fe8290c
SSDEEP 768:QF+B3twgtxlCvaNam5Zu4aWADIidy8Lup+/vmdTr1FnomU:HB3ym5ZzaNsuVL3/o7n7U
TLSH
T149037B7AEC55DEBBA8F6A785B7467A47DEF441A3C48C89D4C9C81E4D00D31AE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fb5e7787f896d0ab027f7a360622c931e20e59cc97b5800e83972e05108c7dd5
MD5 7c6d1b1972e3f278ce12f5abbb4fb5c9
SHA1 c5d2ef963e2e7e24ab6675847b38bc0aa2470a22
SHA512 905ec49c2e5bf04d4f704eec5d0507e41cd5c7602eb66607217b5a74e1a9be7e3b3e76c5604b94e4a50b9ff0051721b89a07190b1722735c7721ac5211720425
SSDEEP 768:8rv+4UNbdC3rzCBqobGaNntZu4aWADIidy8Lup+eBI:8bsbg32tZzaNsuVL3oI
TLSH
T17403AF75F869DE739CFAA244B2873A477EF851A384C90AD4C8DC1B4E44871AE231BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b7bc3af79b5dfccb647adf62c4ec8d7573d489906ae5eae1c81c52758987b469
MD5 d8049996fafe11facfd2fe18600b8b91
SHA1 f4dfcbbb7049932184696c3ed5fb9bc773f4b26b
SHA512 8ecc80a7a03a092012e7e0402c3910fc1c877f9263412dfcaef2226c1855e013852f9bcf95ea9b24ee270d7880cb421275603c94a2ae76094d9bd3ec6febb2de
SSDEEP 768:crv+4UNbdC37FMBqobGaNhtZu4aWADIidy8Lbp+eVH1S1C:cbsbw3OtZzaNsuVL0EH1d
TLSH
T17603CF76A869DE739CF7A244B1877A4B7EF861A3C4890AD4C8CC1B4E45874AD130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 559a64799af4470c1f3f6001cb2e73909bd625ea8528f8c5e53b068d77c51538
MD5 87785991abcaecbfdbd8b9005c399e23
SHA1 a213d4cdc9cd1d6fe7588aa4d5cd201afb6568ed
SHA512 960dff51d93e86c14b9742add246caef26647d30addf6bdb75858773b5af3ea6687a0e6bad8bbf0dd4e2a26a19a666570f005dc272924eb833c088f4e22e5941
TLSH
T1ABE00107934201DEC024033041871F342BA3D030561247975F6002982C253442F20E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1888f3bb7f9042f51dce932e15882e45c5e456ca1e7463fca82800871547cd69
MD5 6f3a7d54b24ccbaa4008272df1b0a655
SHA1 5b210190112786148e19132cfbd3c9a04ae428a3
SHA512 ec13b6c81641b8b84708b76a76d82f7a4605941bcfd3182e0e2ae38ad390e06dde38b706180290d50cdbceb065d3d5281eb470adcf4ab4230911232c5804c5d0
TLSH
T137E00907535201DFC025433641871F742BA3D2305623479B5F6052AC6C293892F21EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 edc311c98af91724c002e998c1f8cc0ffcd67654467a871a551be143b0066059
MD5 c509d750f2056fba9d96b13eaaa6be22
SHA1 58cc37a21e220a08449257c6988a551518f1295e
SHA512 c3cc3e8490ebffed89cf680b21d7b7b2d5ee4520b4d31f1031f8f36c4cb9e321140ce11a956cfb097ca124dd1d68454765a7491f9ec73dc4c6cd02945eef9020
TLSH
T186E04817030241EFC038033501C31F342BB3C13002A3838A5E2101A83C123951F30EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a018e10fd5c9927ec55938458168495a2d1d8f3f3cb6443530defaca2cf7df93
MD5 54b7149ebfa222fc8dc1897dbe4d2f5b
SHA1 fba945c3fc28a623a80d5434e27fb55e5acee8e7
SHA512 c64d01d11ae75d902d1b33a2d832388af91e6790b480526446abbf0d546bea8eeb6930104b40b9f15abd039c88885b7df440df650b6926e9bd0f6a790359dadc
TLSH
T1B8E00207930201DEC028033041871F342FE3C030155147579F6001DC3C263403F30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 73acf3c9d127d720ca917d1604106e5226d525eb92795d87437395bfb6ffd0c4
MD5 837f4a3b7426d6db6200c89fe7fd77f2
SHA1 53f1f3b109d570f0cd97fb7f19ac8a53f2ff0d0e
SHA512 7b8f21d5118ca9cf58ebbf5b7a9d140e233d385c15464bf149a27154a34178633de4288bdc498dca241e62d3df9fa131dd1b0a08d7cd04881aaf8d335a2d996a
TLSH
T1E2E00907934201AFC024433041871F342BA2D030562347975A6002A86C263842F20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 175dda891b1baf4c6142bc1d9213ac1526da6c467464b958f3dbb6204b2b546f
MD5 68440b131adb54193af701ce8b778d4d
SHA1 7eef19caaf734e992eb54d13fb715438e2847102
SHA512 f55c45a6faa93a30582f364ef8cfe27cecc732b8f73a8633b0a82b629485e60e6d1762d3a4009217ccd92f7386adbd3072d490606105f2831a98cfd33f821101
TLSH
T103E0042B935201EFC439433641C72F752BB3D2745767879AAE6452A86C263892F25EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 33533d51c03c18489d8df12bc39911f0648a6aaa978fa6c3d5db641f50b91550
MD5 4c7a3554036b52b4ff5e1f9de6927540
SHA1 a6be7d54e42c1504ed6203464008541d6e2aa3a7
SHA512 3e092200946b347e4228f4c12f7ea520a66f4378c9796da98727dd34065d7d559cece6688bcecd99d0763dec21e71cd1bd0ec6be944475d252bd8b5770e6ccb6
TLSH
T1EBE0092B535211DFC435433641872F752BF3D2745727879AAF6052AC6C2A3892F21FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c5329.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c5329.TMP
Size 392B
SHA256 56c4d2a10ddfdf7bd3f71cf78393207c3720c57edcafb2f4eb3a4e820e546a38
MD5 d65a8a0f4480d2955b7376ea275fa866
SHA1 0c4c7ef6e37dc31f721cc32104aec0978463d581
SHA512 022c83a87c18b00884ffda361be1acf18bea78e2671a433440b0cb611adf09e17a79eed2943c04b43f81958936cbe8953db6854802621e8c9c70fd847b1b30fd
TLSH
T18AE002055302015DC028033041431F241BD1C01015614357975001982C163002E30A80
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d101e208-fab6-4815-813f-41b159cfb5ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d101e208-fab6-4815-813f-41b159cfb5ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5af166.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5af166.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

9b793a3c-8a63-4a7b-be57-7a315846712e.tmp

Path C:\Users\Admin\AppData\Local\Temp\9b793a3c-8a63-4a7b-be57-7a315846712e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1876_1425672382\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8612-3543-0x00007FFFD1DB0000-0x00007FFFD2CC2000-memory.dmp

Download

memory/8612-3540-0x00007FFFD1DB0000-0x00007FFFD2CC2000-memory.dmp

Download

memory/8612-3552-0x00007FFFD1DB0000-0x00007FFFD2CC2000-memory.dmp

Download