d0f2358e1970589182a2b03ea08ee2204938dcbaa4f2b1d59331e22e1bfa4d37

Analysis

user interaction
yes
max time kernel
387s
max time network
418s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/09/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UnlockTool-2026-09-02-0.exe
Size 231.3MB
Sample260916-tsb2dasgrc
SHA256 d0f2358e1970589182a2b03ea08ee2204938dcbaa4f2b1d59331e22e1bfa4d37
MD5 83ef0bebc2566df0b3a59e6c2a6d859a
SHA1 cd45c5327dcc48e8fdf5fb37494baa66fc880f67
SHA512 7502af44eb8dec5b9bd550db79164927d425f4e9910106e06f7d30abc5452ea2dd8c46414bac5dbb6f1d9d9294b7936db5e13964b396f63a780ad2d26d279914
SSDEEP 6291456:TRWvkdQEprXHbSuDmFL9tdQA3rzkwwft1wE+NP:T8v7kS4mftdf3XitC7P
TLSH
T1F6C8334A1149C0EBEA511A34A33A11970275ADCC18ADF86E36C07EBDB37FEB905357B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\0E68FCF27C261EAA0F0DE3053E2B3A5692F6CA2E\Blob = 0300000001000000140000000e68fcf27c261eaa0f0de3053e2b3a5692f6ca2e2000000001000000e0020000308202dc30820245a003020102021073418b10d7cd62ac4030c34e3ecb6f66300d06092a864886f70d01010b0500306d316b306906035504031e62006c00690062007500730062004b00200028004100700070006c0065005f004d006f00620069006c0065005f004400650076006900630065005f004400460055005f004d006f00640065002e0069006e006600290020005b00530065006c0066005d301e170d3232313131303034323033345a170d3239303130313030303030305a306d316b306906035504031e62006c00690062007500730062004b00200028004100700070006c0065005f004d006f00620069006c0065005f004400650076006900630065005f004400460055005f004d006f00640065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100a4ee10ebc746ae724fc8d91af422afa9fd558688b0c55f6c43f3114f3e227854e801d665beb5adb2763043e74121e4096dc475303884e10b1838ee74e0c3d65cfbb12bed4de738f06152617e894c21ed07773dcb0f36ec93f46ce5b5597f0ff2c3a68b4ba346bfecc053371f7266ad434fce59b4fb4954ee5f24af4aab607c2d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b050003818100701893371ccb5bdeea602d51459632aa48e3ff738fc14e95a16f85a231a406a54afa6238e8897828176d7f28c6e881387263c4927a31d8e1f1a57928e297eb62222bcc41da7d59085571acad6dc2642a3d9d21cb48b993f231d560b0be671ad5e7841cb18dc9386e883fa2499902672d25ba4e5258a240a9f7376003a57910c4	UnlockTool-2026-09-02-0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FBE11F6170659F4A3064D3159FE8FFCE0CE06C67\Blob = 030000000100000014000000fbe11f6170659f4a3064d3159fe8ffce0ce06c672000000001000000e7050000308205e3308203cba00302010202107eb0af01977017a545f699ea3889f612300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00300035004100430026005000490044005f003100320032003700200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3232303431393136343931325a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00300035004100430026005000490044005f003100320032003700200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a028202010090641fdbf995019ade845ff65c0399997699266ef2b60a1cd75df5c7e5d4926ca7c845797cc3885a0ec6dada1b7d546f63eda5631db386ba7828bb7532f1e2abf3c6c8e9e672a2c8766e78087b46e275d49b2e7573b2c8260a6e0605ee347105d7dfea689b90e5af33881b92498ef19bedcce12b1bec6c5f1dfb0b51c5bae578269c9910b68ad0cef9dfbec9586c63bac5ad13711187f007627f9a4cee19dfa59fbd798378f269dbc5866ce56b5938116e5d5c59600f5099c03065c7c2e99bcf94d749f0dc84c9de5e6bdf9695bd4384a1ec131175a34800b7a2fbfcee562a0a2bc282ecc288d068169d81b9b48db5723fb97a0d7f8106901ea27c15edb45df2278c6dce0515b70c35c9a58fb91bec0bfec791a7a7f172469521e1340f88e867bd98fb3507ced81a6f91379628d96528786360bf7bc55a1e871efd46e6997b1ab119aa6c020d221552aab92b4964b62f647a107eb35855a4f288abbf87fca6ee39344486a37de1b2ad7b5f537e4126e7ca57dbb580b9384b4ff84689bd40c0529bc4b28be5f11b3a48b2ea527ed918565c716c2374353b18a723b978334db6f46d244450ae9df4c2f496078dae28b5ab1fe0d05e5fb597450a43f578429d6c2cee799a919db0c9a47b999372126dc8d36286ddcbd472f09c616611c409190b2e511ce5ed0086d522ccd615e4f513a2f898d652fdfebd7928f47b103438941c510203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b050003820201000a3dde4665593726d8e543f39c750cdfe780b154c5241b979420c9153c595e2c2b4e36516c5cc4925f4cd161389cfc2c3a527141f5670b5862648be14cb8012d4581e1d117c5f58421d91d0f7e99ee27e370dbe60af3c9087efd51db9d25947348056610452e93f6503897cf03c4bf7d90873d18e790666ac47a69fef3a66667229b440d39b57ec3d73c9838f95d0368faf7aeded3c68a95dd8b06c1a512412646908e28c6497406bc313b92386e25bd70541ecedf2b2ee95aae6fc0fbba442939c403ce4d8c23103d972e8aef0eec76d807f50f5c1043738a2b183deb34d880d1e33eadaa085f520b19f17ccd41d9739b2d25ec524e5ae5afd52f5c5409f3db801764630a307e15557d1023df8bd2fabccc4229424f5f00cf7ebbe8c7b30e769ee8a30b55e38415aa747b0a4bf8dad24cd220d4b3d2a3e9e9175e2767a5d26cea925c0d4e5fe9139d52aa22236eca16802bd593dc8e91afe55c39b0ea441f74c4ed9491137f8a997220ac6f8f3314bad918e72fa7b5a6086058a4e928bd0003c7618c43015a843e5d7aca890c2717bea5b30954ac6aaee5b940af506a3b13d4bd14f4da34c2ed7b78ac9588d1df6a282b9058a704bba2ed4672886e673d1b60f0011933bbde15cf7980592b84ad13dfae1396d9294f4dfa28efaf4eb3c7069e17093af78a3cd4c73a172119ae4d7abdf8932bbe09891e06e62e93cd72697e96	UnlockTool-2026-09-02-0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1214720699\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1472778537\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1671925911\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1671925911\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1212992354\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1212992354\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_625031821\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1214720699\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1214720699\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1472778537\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1963305781\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_625031821\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1862942102\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1472778537\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1671925911\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1671925911\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1212992354\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1862942102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1214720699\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1472778537\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1671925911\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1671925911\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1212992354\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0E68FCF27C261EAA0F0DE3053E2B3A5692F6CA2E\Blob = 0300000001000000140000000e68fcf27c261eaa0f0de3053e2b3a5692f6ca2e2000000001000000e0020000308202dc30820245a003020102021073418b10d7cd62ac4030c34e3ecb6f66300d06092a864886f70d01010b0500306d316b306906035504031e62006c00690062007500730062004b00200028004100700070006c0065005f004d006f00620069006c0065005f004400650076006900630065005f004400460055005f004d006f00640065002e0069006e006600290020005b00530065006c0066005d301e170d3232313131303034323033345a170d3239303130313030303030305a306d316b306906035504031e62006c00690062007500730062004b00200028004100700070006c0065005f004d006f00620069006c0065005f004400650076006900630065005f004400460055005f004d006f00640065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100a4ee10ebc746ae724fc8d91af422afa9fd558688b0c55f6c43f3114f3e227854e801d665beb5adb2763043e74121e4096dc475303884e10b1838ee74e0c3d65cfbb12bed4de738f06152617e894c21ed07773dcb0f36ec93f46ce5b5597f0ff2c3a68b4ba346bfecc053371f7266ad434fce59b4fb4954ee5f24af4aab607c2d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b050003818100701893371ccb5bdeea602d51459632aa48e3ff738fc14e95a16f85a231a406a54afa6238e8897828176d7f28c6e881387263c4927a31d8e1f1a57928e297eb62222bcc41da7d59085571acad6dc2642a3d9d21cb48b993f231d560b0be671ad5e7841cb18dc9386e883fa2499902672d25ba4e5258a240a9f7376003a57910c4	UnlockTool-2026-09-02-0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FBE11F6170659F4A3064D3159FE8FFCE0CE06C67\Blob = 030000000100000014000000fbe11f6170659f4a3064d3159fe8ffce0ce06c672000000001000000e7050000308205e3308203cba00302010202107eb0af01977017a545f699ea3889f612300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00300035004100430026005000490044005f003100320032003700200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3232303431393136343931325a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00300035004100430026005000490044005f003100320032003700200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a028202010090641fdbf995019ade845ff65c0399997699266ef2b60a1cd75df5c7e5d4926ca7c845797cc3885a0ec6dada1b7d546f63eda5631db386ba7828bb7532f1e2abf3c6c8e9e672a2c8766e78087b46e275d49b2e7573b2c8260a6e0605ee347105d7dfea689b90e5af33881b92498ef19bedcce12b1bec6c5f1dfb0b51c5bae578269c9910b68ad0cef9dfbec9586c63bac5ad13711187f007627f9a4cee19dfa59fbd798378f269dbc5866ce56b5938116e5d5c59600f5099c03065c7c2e99bcf94d749f0dc84c9de5e6bdf9695bd4384a1ec131175a34800b7a2fbfcee562a0a2bc282ecc288d068169d81b9b48db5723fb97a0d7f8106901ea27c15edb45df2278c6dce0515b70c35c9a58fb91bec0bfec791a7a7f172469521e1340f88e867bd98fb3507ced81a6f91379628d96528786360bf7bc55a1e871efd46e6997b1ab119aa6c020d221552aab92b4964b62f647a107eb35855a4f288abbf87fca6ee39344486a37de1b2ad7b5f537e4126e7ca57dbb580b9384b4ff84689bd40c0529bc4b28be5f11b3a48b2ea527ed918565c716c2374353b18a723b978334db6f46d244450ae9df4c2f496078dae28b5ab1fe0d05e5fb597450a43f578429d6c2cee799a919db0c9a47b999372126dc8d36286ddcbd472f09c616611c409190b2e511ce5ed0086d522ccd615e4f513a2f898d652fdfebd7928f47b103438941c510203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b050003820201000a3dde4665593726d8e543f39c750cdfe780b154c5241b979420c9153c595e2c2b4e36516c5cc4925f4cd161389cfc2c3a527141f5670b5862648be14cb8012d4581e1d117c5f58421d91d0f7e99ee27e370dbe60af3c9087efd51db9d25947348056610452e93f6503897cf03c4bf7d90873d18e790666ac47a69fef3a66667229b440d39b57ec3d73c9838f95d0368faf7aeded3c68a95dd8b06c1a512412646908e28c6497406bc313b92386e25bd70541ecedf2b2ee95aae6fc0fbba442939c403ce4d8c23103d972e8aef0eec76d807f50f5c1043738a2b183deb34d880d1e33eadaa085f520b19f17ccd41d9739b2d25ec524e5ae5afd52f5c5409f3db801764630a307e15557d1023df8bd2fabccc4229424f5f00cf7ebbe8c7b30e769ee8a30b55e38415aa747b0a4bf8dad24cd220d4b3d2a3e9e9175e2767a5d26cea925c0d4e5fe9139d52aa22236eca16802bd593dc8e91afe55c39b0ea441f74c4ed9491137f8a997220ac6f8f3314bad918e72fa7b5a6086058a4e928bd0003c7618c43015a843e5d7aca890c2717bea5b30954ac6aaee5b940af506a3b13d4bd14f4da34c2ed7b78ac9588d1df6a282b9058a704bba2ed4672886e673d1b60f0011933bbde15cf7980592b84ad13dfae1396d9294f4dfa28efaf4eb3c7069e17093af78a3cd4c73a172119ae4d7abdf8932bbe09891e06e62e93cd72697e96	UnlockTool-2026-09-02-0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnlockTool-2026-09-02-0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3460	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	UnlockTool-2026-09-02-0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	UnlockTool-2026-09-02-0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	UnlockTool-2026-09-02-0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	UnlockTool-2026-09-02-0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	UnlockTool-2026-09-02-0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	UnlockTool-2026-09-02-0.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340492951447515"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2545564138-786060179-1728272436-1000\{BCEC4E3A-C2DA-46AA-BA84-E8789B9BA4C2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FBE11F6170659F4A3064D3159FE8FFCE0CE06C67	UnlockTool-2026-09-02-0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FBE11F6170659F4A3064D3159FE8FFCE0CE06C67\Blob = 030000000100000014000000fbe11f6170659f4a3064d3159fe8ffce0ce06c672000000001000000e7050000308205e3308203cba00302010202107eb0af01977017a545f699ea3889f612300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00300035004100430026005000490044005f003100320032003700200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3232303431393136343931325a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00300035004100430026005000490044005f003100320032003700200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a028202010090641fdbf995019ade845ff65c0399997699266ef2b60a1cd75df5c7e5d4926ca7c845797cc3885a0ec6dada1b7d546f63eda5631db386ba7828bb7532f1e2abf3c6c8e9e672a2c8766e78087b46e275d49b2e7573b2c8260a6e0605ee347105d7dfea689b90e5af33881b92498ef19bedcce12b1bec6c5f1dfb0b51c5bae578269c9910b68ad0cef9dfbec9586c63bac5ad13711187f007627f9a4cee19dfa59fbd798378f269dbc5866ce56b5938116e5d5c59600f5099c03065c7c2e99bcf94d749f0dc84c9de5e6bdf9695bd4384a1ec131175a34800b7a2fbfcee562a0a2bc282ecc288d068169d81b9b48db5723fb97a0d7f8106901ea27c15edb45df2278c6dce0515b70c35c9a58fb91bec0bfec791a7a7f172469521e1340f88e867bd98fb3507ced81a6f91379628d96528786360bf7bc55a1e871efd46e6997b1ab119aa6c020d221552aab92b4964b62f647a107eb35855a4f288abbf87fca6ee39344486a37de1b2ad7b5f537e4126e7ca57dbb580b9384b4ff84689bd40c0529bc4b28be5f11b3a48b2ea527ed918565c716c2374353b18a723b978334db6f46d244450ae9df4c2f496078dae28b5ab1fe0d05e5fb597450a43f578429d6c2cee799a919db0c9a47b999372126dc8d36286ddcbd472f09c616611c409190b2e511ce5ed0086d522ccd615e4f513a2f898d652fdfebd7928f47b103438941c510203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b050003820201000a3dde4665593726d8e543f39c750cdfe780b154c5241b979420c9153c595e2c2b4e36516c5cc4925f4cd161389cfc2c3a527141f5670b5862648be14cb8012d4581e1d117c5f58421d91d0f7e99ee27e370dbe60af3c9087efd51db9d25947348056610452e93f6503897cf03c4bf7d90873d18e790666ac47a69fef3a66667229b440d39b57ec3d73c9838f95d0368faf7aeded3c68a95dd8b06c1a512412646908e28c6497406bc313b92386e25bd70541ecedf2b2ee95aae6fc0fbba442939c403ce4d8c23103d972e8aef0eec76d807f50f5c1043738a2b183deb34d880d1e33eadaa085f520b19f17ccd41d9739b2d25ec524e5ae5afd52f5c5409f3db801764630a307e15557d1023df8bd2fabccc4229424f5f00cf7ebbe8c7b30e769ee8a30b55e38415aa747b0a4bf8dad24cd220d4b3d2a3e9e9175e2767a5d26cea925c0d4e5fe9139d52aa22236eca16802bd593dc8e91afe55c39b0ea441f74c4ed9491137f8a997220ac6f8f3314bad918e72fa7b5a6086058a4e928bd0003c7618c43015a843e5d7aca890c2717bea5b30954ac6aaee5b940af506a3b13d4bd14f4da34c2ed7b78ac9588d1df6a282b9058a704bba2ed4672886e673d1b60f0011933bbde15cf7980592b84ad13dfae1396d9294f4dfa28efaf4eb3c7069e17093af78a3cd4c73a172119ae4d7abdf8932bbe09891e06e62e93cd72697e96	UnlockTool-2026-09-02-0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0E68FCF27C261EAA0F0DE3053E2B3A5692F6CA2E	UnlockTool-2026-09-02-0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FBE11F6170659F4A3064D3159FE8FFCE0CE06C67	UnlockTool-2026-09-02-0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\0E68FCF27C261EAA0F0DE3053E2B3A5692F6CA2E	UnlockTool-2026-09-02-0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\0E68FCF27C261EAA0F0DE3053E2B3A5692F6CA2E\Blob = 0300000001000000140000000e68fcf27c261eaa0f0de3053e2b3a5692f6ca2e2000000001000000e0020000308202dc30820245a003020102021073418b10d7cd62ac4030c34e3ecb6f66300d06092a864886f70d01010b0500306d316b306906035504031e62006c00690062007500730062004b00200028004100700070006c0065005f004d006f00620069006c0065005f004400650076006900630065005f004400460055005f004d006f00640065002e0069006e006600290020005b00530065006c0066005d301e170d3232313131303034323033345a170d3239303130313030303030305a306d316b306906035504031e62006c00690062007500730062004b00200028004100700070006c0065005f004d006f00620069006c0065005f004400650076006900630065005f004400460055005f004d006f00640065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100a4ee10ebc746ae724fc8d91af422afa9fd558688b0c55f6c43f3114f3e227854e801d665beb5adb2763043e74121e4096dc475303884e10b1838ee74e0c3d65cfbb12bed4de738f06152617e894c21ed07773dcb0f36ec93f46ce5b5597f0ff2c3a68b4ba346bfecc053371f7266ad434fce59b4fb4954ee5f24af4aab607c2d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b050003818100701893371ccb5bdeea602d51459632aa48e3ff738fc14e95a16f85a231a406a54afa6238e8897828176d7f28c6e881387263c4927a31d8e1f1a57928e297eb62222bcc41da7d59085571acad6dc2642a3d9d21cb48b993f231d560b0be671ad5e7841cb18dc9386e883fa2499902672d25ba4e5258a240a9f7376003a57910c4	UnlockTool-2026-09-02-0.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
5064	UnlockTool-2026-09-02-0.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
5064	UnlockTool-2026-09-02-0.exe
824	CredentialUIBroker.exe
6900	CredentialUIBroker.exe
6744	CredentialUIBroker.exe
5064	UnlockTool-2026-09-02-0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3320	5064	UnlockTool-2026-09-02-0.exe	85
PID 3320 wrote to memory of 4828	3320	msedge.exe	86
PID 3320 wrote to memory of 3460	3320	msedge.exe	87
PID 3320 wrote to memory of 2140	3320	msedge.exe	88
PID 3320 wrote to memory of 2140	3320	msedge.exe	88
PID 3320 wrote to memory of 2140	3320	msedge.exe	88
PID 3320 wrote to memory of 3996	3320	msedge.exe	89
PID 3320 wrote to memory of 3996	3320	msedge.exe	89
PID 3320 wrote to memory of 1596	3320	msedge.exe	90
PID 3320 wrote to memory of 4200	3320	msedge.exe	91
PID 3320 wrote to memory of 1596	3320	msedge.exe	90
PID 3320 wrote to memory of 1596	3320	msedge.exe	90
PID 3320 wrote to memory of 4200	3320	msedge.exe	91
PID 3320 wrote to memory of 4200	3320	msedge.exe	91
PID 3320 wrote to memory of 2356	3320	msedge.exe	93
PID 3320 wrote to memory of 3208	3320	msedge.exe	94
PID 3320 wrote to memory of 2356	3320	msedge.exe	93
PID 3320 wrote to memory of 2356	3320	msedge.exe	93
PID 3320 wrote to memory of 3208	3320	msedge.exe	94
PID 3320 wrote to memory of 3208	3320	msedge.exe	94
PID 3320 wrote to memory of 4072	3320	msedge.exe	96
PID 3320 wrote to memory of 4072	3320	msedge.exe	96
PID 3320 wrote to memory of 528	3320	msedge.exe	98
PID 3320 wrote to memory of 528	3320	msedge.exe	98
PID 3320 wrote to memory of 528	3320	msedge.exe	98
PID 3320 wrote to memory of 2460	3320	msedge.exe	99
PID 3320 wrote to memory of 2460	3320	msedge.exe	99
PID 3320 wrote to memory of 5004	3320	msedge.exe	101
PID 3320 wrote to memory of 5004	3320	msedge.exe	101
PID 3320 wrote to memory of 5004	3320	msedge.exe	101
PID 3320 wrote to memory of 4520	3320	msedge.exe	102
PID 3320 wrote to memory of 4520	3320	msedge.exe	102
PID 3320 wrote to memory of 4520	3320	msedge.exe	102
PID 3320 wrote to memory of 1644	3320	msedge.exe	103
PID 3320 wrote to memory of 4732	3320	msedge.exe	104
PID 3320 wrote to memory of 1644	3320	msedge.exe	103
PID 3320 wrote to memory of 4732	3320	msedge.exe	104
PID 3320 wrote to memory of 220	3320	msedge.exe	106
PID 3320 wrote to memory of 2512	3320	msedge.exe	107
PID 3320 wrote to memory of 2512	3320	msedge.exe	107
PID 3320 wrote to memory of 2236	3320	msedge.exe	108
PID 3320 wrote to memory of 2236	3320	msedge.exe	108
PID 3320 wrote to memory of 4604	3320	msedge.exe	109
PID 3320 wrote to memory of 4488	3320	msedge.exe	110
PID 3320 wrote to memory of 4604	3320	msedge.exe	109
PID 3320 wrote to memory of 4488	3320	msedge.exe	110
PID 3320 wrote to memory of 1372	3320	msedge.exe	113
PID 3320 wrote to memory of 1372	3320	msedge.exe	113
PID 3320 wrote to memory of 3836	3320	msedge.exe	114
PID 3320 wrote to memory of 3836	3320	msedge.exe	114
PID 3320 wrote to memory of 3836	3320	msedge.exe	114
PID 3320 wrote to memory of 2044	3320	msedge.exe	115
PID 3320 wrote to memory of 2044	3320	msedge.exe	115
PID 3320 wrote to memory of 2044	3320	msedge.exe	115
PID 3320 wrote to memory of 388	3320	msedge.exe	116
PID 3320 wrote to memory of 388	3320	msedge.exe	116
PID 3320 wrote to memory of 388	3320	msedge.exe	116
PID 3320 wrote to memory of 4184	3320	msedge.exe	117
PID 3320 wrote to memory of 4184	3320	msedge.exe	117
PID 3320 wrote to memory of 4184	3320	msedge.exe	117
PID 3320 wrote to memory of 3084	3320	msedge.exe	118
PID 3320 wrote to memory of 3084	3320	msedge.exe	118
PID 3320 wrote to memory of 4464	3320	msedge.exe	119
PID 3320 wrote to memory of 4464	3320	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\UnlockTool-2026-09-02-0.exe
"C:\Users\Admin\AppData\Local\Temp\UnlockTool-2026-09-02-0.exe"
1⤵
- Manipulates Digital Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://unlocktool.net/register/
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x310,0x7ff9c20bc188,0x7ff9c20bc194,0x7ff9c20bc1a0
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,634399919586924329,11044555450198669128,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,16706944589920586402,5608490242288329499,262144 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,17768561687568875838,11502097411981711476,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12329642544980709101,12578563273098543040,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,5211913481397388746,9746401764430936726,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5082256378750220924,13247697348556555980,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,7192254294842747863,16742617280364237607,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17895318490940495357,8471338877697341488,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3644,i,9589680953996008369,2033850201480067918,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11896512328219932685,13552965066620317217,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5676,i,12713043143488410173,10210930627786701536,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5832,i,8939951850146170663,15279340455889017088,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,15418877969708917873,893666094845970703,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3197654965793207525,11078096943169784468,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14002885357025598898,16084720407734590638,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14002885357025598898,16084720407734590638,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,16210707076184515114,9099353612065794607,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13429013017226421794,9514721857416566414,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,8172445662795381964,12266443331780408387,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,11639924353972513179,12031311973001365177,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,10938792755127071048,1850481695559023377,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6756,i,2320530592857747964,1115582801038381668,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5580,i,9850896702037449623,932110028601172770,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4804,i,1326383687920760519,12815634959657320395,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4424,i,4192419341020207499,10190602872972729743,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,1269517614773898582,15775262309770185047,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7464,i,16779053543533598412,80954707417983058,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6680,i,16802391028255974920,16006098612118944742,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6572,i,18254535365015656531,10396553507854775074,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:1
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7312,i,10601989243280677032,2096815859851615027,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6520,i,3116730837983428760,16954195621835343472,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7644,i,17029430661047766620,4119408692944950544,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7796,i,8829236142870290441,7779909978919312607,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8272,i,16693586095451072736,11109589868463099900,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7016,i,18313226439413675659,434330997760948064,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:1
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8052,i,4466001197720957080,564182685322483150,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8388,i,12785074770356569880,2837047748604783889,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8360,i,14789771265323109117,3724802877126828794,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7676,i,18093358943984640950,4985008194532930522,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8356,i,12535589055266580741,18219081621878820975,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8456,i,12991362627173893532,11601625011100736386,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8612 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8444,i,8541358534685404626,4302131026454582898,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8732,i,4471716227293277925,1585455179506886900,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8828 /prefetch:1
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8812,i,18003428416596932127,5957556211960749254,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8864,i,5471361699199561151,6307706522849020047,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8952,i,11298375758679167212,8450275296709955240,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9000,i,10951754324282934485,11267740048745030384,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9012,i,15385224595673706126,11128458576494168319,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9392 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9024,i,5385361282657204325,10240855649583567485,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9424 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10316,i,11336653710278473597,1701004277320711390,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:8
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10296,i,14497979055404851059,7743647727057149156,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10332 /prefetch:8
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9132,i,9071792950392443360,16707444820194151557,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10360 /prefetch:8
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10592,i,12734088233066507422,7856743046909945414,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10608 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10800,i,17747221705386397802,6839537413990558547,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10904,i,8321667389377812620,12876289201604143390,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10912 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10812,i,5991588741983433471,8471804545102071157,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10856 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=10772,i,2146875731657718722,10921886310053420404,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:1
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10368,i,9609428088171455339,15476424743140178027,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9632,i,9387521238448428317,17259786922312506500,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9468 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9712,i,5754133923645016465,10424055437122579635,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11024 /prefetch:1
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7952,i,14230366135945482230,13392707937929828382,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:1
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8500,i,3560141069291430773,3503672327873169240,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9704 /prefetch:1
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7864,i,11237232914221488140,16758545832701002476,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11244 /prefetch:1
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11436,i,11451715372014557397,15995605299517459768,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10900 /prefetch:1
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=11556,i,7897898218816878031,7418451296079685627,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11564 /prefetch:1
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=11600,i,16502242315566023011,8509132145502673942,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11692 /prefetch:1
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=11756,i,2410881114023044027,6558195304392826868,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11880 /prefetch:1
    3⤵
    PID:6316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=11836,i,65173072778698935,11292201023326944661,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11932 /prefetch:1
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=11864,i,16294847020719013309,4138801785540799616,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11936 /prefetch:1
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=12016,i,861690050421850267,827591094366971941,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:1
    3⤵
    PID:6628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=11136,i,12979502308950591212,2580368771717420237,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11156 /prefetch:1
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=11012,i,12816076274386423780,14927298085374084935,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12444,i,1432349716249359334,1147138318917235794,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11432 /prefetch:8
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9780,i,8803205505286242486,17143959483763791402,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11272 /prefetch:1
    3⤵
    PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=12224,i,15777550810978772043,12038343842453092863,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=12024 /prefetch:1
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=11440,i,5408309307647373683,8110720774007381818,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11984 /prefetch:1
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12996,i,14390668330501058018,12076366990563482739,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=13004 /prefetch:8
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,914393065139147643,1374709094804574055,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,11946064936088567097,15547566978310790792,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12496,i,6915409167836451378,9594892316106535457,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=12484 /prefetch:8
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12496,i,6915409167836451378,9594892316106535457,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=12484 /prefetch:8
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=6024,i,15783340068339324610,1729046685224220457,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=11140,i,5852159179942022209,6802790094336737946,262144 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=12512 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12548,i,12063675660438676014,6398424316605510809,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:8
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=3684,i,6241440718233468276,18098687726314712681,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,17633409720066086215,5349612694373837685,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=13124 /prefetch:8
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13132,i,7464493349190971290,6987141643049711578,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13220,i,18090688647220652170,6557705106528739380,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=13268 /prefetch:8
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,14749000877162201957,9706831681968558437,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=13192 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11632,i,2086441974101587444,6149416799501318315,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10996 /prefetch:8
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,16389547233514093810,11784750290300727820,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,7910946565184619083,13762285578894776859,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,5985382976441006104,11261040897711589832,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13268,i,12305319448489453887,1228465535681791985,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=6972,i,12623697622606418648,4868881057532906663,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
    3⤵
    PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=12492,i,2284734508961078791,14857793723669050120,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,13734711847485863077,7502138267023691009,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11484 /prefetch:8
    3⤵
    PID:6576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=13084,i,8913725215247980286,2747032852322642322,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11684 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=6972,i,10216001338952745331,11393556620558629538,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=12384 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10792,i,8577750028320985670,15612239928189966122,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=10456 /prefetch:8
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=6248,i,17472758721942132909,5822613143672719800,2097152 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=12796 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8612,i,1923407603402312679,17869519420892091770,524288 --field-trial-handle=2216,i,11335738367197777964,12677741258211908375,262144 --variations-seed-version --mojo-platform-channel-handle=11472 /prefetch:8
    3⤵
    PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://unlocktool.net/pricing/
  2⤵
  PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4412

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7004

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6900

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

exynos9820

Path C:\UnlockTool\Binaries\eRecovery\data\exynos9820
Size 19KB
SHA256 c42d62ee0e973411136303d453d2f9f44987e7df8e8205b2ffa9a1e34724413b
MD5 6577ccb2902fe1595d99f8ae17bbb430
SHA1 80bb1abeca96f89e6de2d2ab8a67772bf6d5bb2a
SHA512 241960bcbcbd059640858f08982dbf65da50fd27a0b0fa04d86860216a2e295caeeaf88f33f88f671a900143f196125a147f17d968422de1d6403ea2ac9c6312
SSDEEP 384:bQO5y7kJosBr0AIuOlW3H1gKHLsXreJdT:suy7keQtZOlqhL2rsl
TLSH
T11192F852D982CB27C5D862B6FC4B4E10677296D0C3CF3B23964C421E2E8391DAD7EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exynos9825

Path C:\UnlockTool\Binaries\eRecovery\data\exynos9825
Size 18KB
SHA256 f9e8ad6ce71e04302ba4035432152c0b509fea389ed41ae6ae6893148fd515a9
MD5 cd717bf3a514463a50e196134f47e1f1
SHA1 a87bc47e5cb127b9762f9ecb88daf32bc5a22823
SHA512 39b88b54d00bd66b06005e42586ecf953e2b9abe4fdeb8a6d37662ca2a874c5fd7d134465dd34218ab6c2eb4c2996c94e6cdca90d51f0e99c771f65ca6e9873f
SSDEEP 192:+SdFV17FGrllLFfj3S9FAuMPsSAFJ2BWH8OkdLIjgFTE8FTQ7Iye7v1gGJJBQdYK:+6FrU7FAFJ2BWH88jgOI1g0gdT
TLSH
T1CF820A63E002AF6BC5D46635F8488B05732766E5D38F23239A48012F3FC692A5D77F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb0.dll

Path C:\UnlockTool\Drivers\pwndfu\x86\libusb0.dll
Size 45KB
SHA256 5e84d13636fbce7869cddc8b20c7d83fa0063e98c319e8e5ab751edc9ee1da76
MD5 1a534450750eca1f3d951def8d9965bf
SHA1 7dd82b6d52a840c4979a7515fc7a9ca3725363c4
SHA512 3acdfff24a4d9ebb4e9647afccf95f33b4580980fb35a91eff65a01ce470b0bbc1a3a27c476653911f1fa431757ca64c945da89da54bffa599744f29123ef715
SSDEEP 768:Necy9908dqax/5FdC72/WkFkwUEihlLBHCnp+KCI:Ucy9Pn/LdnFFlUEulEl
TLSH
T160234B076AC09037D4D34176656E33228AFCA470472977CBF39E5A90ABA42D9F537B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e1e58bb256017b393bca96e6e9c71ecd35b375ec6ee8132b1cc75af6a8d14aa
MD5 9b1b3a6862389c8c4cc6ad25c3726c27
SHA1 c9b5b1c71a70ded3544f25381fc33b96c6707883
SHA512 670c15825c2a49c7ed683325c3e5582c6cbef6f391e12bb6fa389b9384e11fd9c5e5b263f1055acbbe43dceb21ab17df76c3cde93a82dc8810aa552de2f2b11e
TLSH
T105D02BF4EACC5DB1E023343523108306724D901038036643E0A0024404C21A112B8060
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92f39ded88b03938d3e4b31017f79311f5bc476c5138786ec4f3009cd32ff139
MD5 0b83970fe3fd024a24ea8bf3342ff0a8
SHA1 35a7f987344c0c20270d574fa6e2734323c3f536
SHA512 545b31bd30e0851289b44ac1dda15dca61ace62dbb4d5b1c4e74f2d22ea35a9e2a2d3cba2fdd8e96b50718338b8e67fe8df33e56c299ce64b0d2ad3791f5dad8
TLSH
T185D02BF4EA8C59B1E023343523118306724D901038032543E0A0024404C116112B8060
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 de46357418e43d426c6cba022b67e6359cc064685a065f076104954a4e1ea4f5
MD5 434c1206fd1dcdf4546b51b1a8131a94
SHA1 edc36133daded6fcd6456f3e560afdf322aaf92b
SHA512 7664d62493353b139f4d4ac6b9dfd5ef0635797db122b72bda8870d6b9c4ab2bfefcc83365a7e95f992424c20a962bb4be8eb83408d1668a64eb6e7b2367fb3d
TLSH
T11DE07DC44ADAC26EE3587647417C678CC3A0370BE2CC6A9A570484847347144F3EE7D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 766c0aa56266186ab514105643d683639105e6c0bf39b963fd58cdc06ed24aaa
MD5 9dbe7e6d40753c20caff8c06099cea64
SHA1 51b246262db61076dd125078eee304b3b0545f2e
SHA512 f9b1eb71ab9f92b33881b7d2a4a500f096e83fa7f4b376dbffa23a6ec6cf8131dd4f5fbd338c7c0e5ca6ec966b4e118a8659e74187d31fca0fe82b4a9d81d0c2
TLSH
T18EE026C804CAC22EB24874874668DB8DC2E0378FA2CC6A9B9B0488857307440B6A27E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 72KB
SHA256 e9af919973925d0b02e9d08f4e432f3507734c6d8254aba04a1478f6a2a608bf
MD5 a58186b560d3fb06d2bea73f57f70e84
SHA1 2eb50efe6c06ea0833d17b4c5abda1b95ca2db9e
SHA512 ff37d989324083b9c848f91ae6c6cf038e6510a7f0423c491cf5ece0ed7475168ca3f6890bcb3bf4d68ad15ef80c2582ed97e27d174d5533b119029d4dc36ad5
SSDEEP 1536:DiQkYkrMHG5Zo3raaT+aXexLIWqctWxDutEGNRICTgsPy022x:DiQkYYMHG5geaqaaUKEItcm
TLSH
T1027302AEE07FBB642EA01B52204E15FF1BE950188394EC5AC4F7624FCBE05910BD64EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 409KB
SHA256 222795c3d9d62aee0918feea986ea328975c714d704d1ecc8322aa6304b27c58
MD5 7d333739648043e773d79c8bb06886f3
SHA1 c7effb15f58a1b6de7fa38487f6938878276a647
SHA512 2103218f2b2cba66536791c608fbd0a7da3e45f488ec6ded25c630c1174ee2e2e8c56643629355f119b26de7e09349d56e0977d47cdaf5734b9db755941a905d
SSDEEP 12288:HbdnxdBqAT0eFAMpPyKqQAGRlyvprwJtC8+a1o:7NoK0eFAtlUlZrC8+v
TLSH
T1F89423604CFD10D041BDD394C70E6D5BB8DEDEA0B924B8DCFBA2D1A2DDF8968506E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ee

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ee
Size 428KB
SHA256 fb0a999fd67735995d044d5d9fbb8c76ad7bc2d6862bea2c00a0c313dda3693f
MD5 641f6ff27fdc5a37a5844d907f2d1112
SHA1 ee308ce107eba5f7f806aa9cba913e8a8426daa1
SHA512 c6a40b4f392696565628b2957c49bd3e21eb3546f5e0bf642da18d855a6af49aeea5566d8497a2c3d59847698a426bf84e24fe957259e9c46b6e724467294bf6
SSDEEP 6144:aMuYRo8bTk8pbmRGfmfsMS8/ySVGntk8wqoRs3AHqqEPKyPQ8caPjqnhIf:28o8bg8KGefnfjVG3wJRsvRK0Tn
TLSH
T17F9402FEBA4BE04DFF9A2072710E4C51E0EE1890A6FCF4369396D95DE006F149A5981F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f2
Size 23KB
SHA256 b3abe6cbbf1ce1afd3cbb60037baf559d3274cfb329d5b7818bd1bce69de1f95
MD5 c09e238dbf5b9860101e358526dfa45a
SHA1 aee727b5f209837ad7b534d84ee85818f99af641
SHA512 a1d5cf268d18460b3efb1565108541b2c298fcb806b26bad9ba8b5f0f01f042030f993a4f3c995070fa780442f409c42dc7e2a53356800e27add896210b63c5b
SSDEEP 384:C8AEDNelDBPOVv1Mr3rHG5+Q7l3sqSUlGz8EOSBq/AJUTrjBCm0o9wbj6POj6R:1xDF1Mr3rHMNZGWSM4MBCmr9waGjm
TLSH
T167B2F1D93F8CC257FBFAEE050F2924E0B4A8285BE8A0392DD2D455317B613A767B4700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 19aa8ba55fd4f3dcc935de1251adea1ae4796c73738f5828ca8e90b9d8a8b107
MD5 5b62d93c50715930d20e0c5771a8df15
SHA1 8a1e0bb97f2a8f0f518d28e62474d1e15b92820a
SHA512 a0d12a2f1cc4a7fd59890f243510c7a7f6ba50a36dfef0cfd3d6edfc6301b6af5eba6575850d63fcbdb9f06deb91e9a3f2e9facc857930652260a6ee81d2be4f
SSDEEP 96:yyqbgkQ4kmVGd4zxh2ZycyMi+vZ/8Anb9KP+rbR7uihECD7+WN:y9ll2diqyMNvEJsN
TLSH
T1B4C18145C0D05EA5EB4A78B953CB6E913AB029FE084B7FFAFAD6D531D74239140B0890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 db0af5c0ed2c182d31d8e0ef004bcc2e84adc1f24bba12c55bda3456534e464a
MD5 038d331c0063e8e40a729e3a697991ab
SHA1 eac38712e0ae63b9410a13a289f836620afba0be
SHA512 8adc1090fdcc9ddff469f85d7d91bd44cff428fdfff9cadb07d88f418d4cb023e906db889330c223a3e4b29eae0a3411ce3452422b876dcccc802f4e964b7f9b
SSDEEP 96:iyqbglQ4kmVGdJzxh2ZycyMiDvQ/8Anb9KP+r3gR7uihE1D7+WN:i9El2dxqyMNvEwxN
TLSH
T1E5C18145C0E05E95EB4A78F943DB6E923AB069BE084B7FFAFAD6D531D74339140B0890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 e18b82abd5bc83793a909d46ac966bd647b47b9591cc19953bc4e1966546e366
MD5 1d1aaa82b0c1b6a6fb3e4d035aa77945
SHA1 c313c1fbcc8013bbb06b549e491b81bcc8e6772b
SHA512 a5e531087110d7b594626404a2afe7fe2d8d67160dcbc612c3a3c1f1518349a1d7e9e6b1cb4885d628efa8a95b97d30ca6b407a90ec73fc0078dfdcdb78772fb
SSDEEP 96:gyqbglQ4kmVGdJzxh2ZycyMiDH/8Anb9KP+r3gR7uihE1D7+WE:g9El2dxqyMuvEwxE
TLSH
T14AC18145C0E04E95EB4A78F943DB6A923AB069FE084B7FFAFAD6D531D74339140B0890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5aa2f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aa2f8.TMP
Size 3KB
SHA256 1710de54ea9425dea9678dd81729cbd6d5419f94280750e0f5be5358399a67d1
MD5 b03b7f5e1ab7e6b5e8ff5d62df096ada
SHA1 f11819d1add0a7c394ccbaa0e3235f784a355d32
SHA512 d9157aafff559073ab4241e078730397e84c36154bb74467595c31981ddf081b6abf1034b91ee585845c69a9515be1e3e7a4b0ef76d55d47656a770f32dbe102
TLSH
T16161E70859C18F67E36BC8349AEC73933AF476FA59B76E2D01E8E434E74276141B00E9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 40KB
SHA256 06170eea9e179982bf2be34d896b74680ca20087edc2b7d790bb7c7f6aee6c7c
MD5 3c278efb36595fc62ffde12a22b05cea
SHA1 c742bcb267fb2c115295ca89a58158dc2df46f43
SHA512 6282cb47a007742bd83e8e28103a5b3476dc8ff35391cbacf7e04ae398b561058c65e4b2c4940af3dd3e8eb1926f1a12265d58018c355234b5e68cf681353af8
SSDEEP 384:DY2hjZz01L/XDiYa8eswvueq4lJQslJZRZ76BhBepctYR5Ji47qJqQqc8igcIcJe:nt4rkELmUF4t0t4rfRyoHb4wZx
TLSH
T11713AEF393F0897EC91352F09A242E1BCF5D045A031C7C7B8AE4AE5757E6872E29164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 3a2022ed5fd3016f1a59bd6af0e2e943817df05657e3424694de0239e8f1c282
MD5 525d3cecb09ce61dfea77e3fcec4da44
SHA1 6bbb2bccd7e72cf25aa9a4f81cb74d65d76fae7c
SHA512 5e465f619ef44fb89bf94e2da832bcc8c76ec1ef01cc770af975616fb549ef3da0174b574ade76b8102b2ab54db3115e56e2a159cccade42249146632e5032df
TLSH
T1B4D022331381B4F6BA6C3E85516BFC8FC72624A09803EDD560D0A898653246C2527A49
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a013a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a013a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 a18b940e6f98c96f6de1cec7e8a7ccf9fd94168ee730dabfcce42f5bfdef10c2
MD5 cf468faec6ffdece69654c394ac25072
SHA1 1199da4a36c8b267e5f3db202331f5cbe7d23e7b
SHA512 e1a106943c43dadf97f3668c4ecbeaaa6d3d731e457215d0defb9c0eeb36f2e659728586166f316e0458534bec60f0649ede4c6c64eb84a92dff96c16e6e6f57
SSDEEP 384:sxZBrmWn/f0siWc16T/PHbMmAl/RRWxBoA8dvTuIn6vbuMtkWs:sJrmWn/fqWbDHbiZRR4sTTn6vdtkd
TLSH
T150C27597B0780A7A4ADD8932F025FF39D79104278AA54EC7AAFCC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6154405a6b16c4774498694fcc388c6b1e48126c33b7b01de744130b4c3621d2
MD5 135bd3438e079383d67530112ad22947
SHA1 350e6266030fd04cf32abd7ebcd968b44f4d47d0
SHA512 191221da999d82a253aa6bb4729d2dfbde6bf43637fcdb039dfbf3f482008e14ac78ebbe4be9462bd33027b537a92d9f31cbcd635bebfbd64ca3fe25c05dad00
SSDEEP 192:sxZSRMZn/f0sk/O9NxIdpWqBHW6+WNLlq/zjrVvVFIg4J:sxZSSn/f0sqW6DHbo/Vc
TLSH
T15132A556BE38A93B4CC6D219BB25BF13D6F5103291D51E58AAFC871C05EA6DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 c91791125b99d44fe68da32ae3e139370843cba116086f113a5a67e8d05bf2ad
MD5 49650e7363626e8de77fc496ace93a15
SHA1 00795c61650965a4df0f3ccd5f5611f2fe694d85
SHA512 fbefc85b9f1defe16c82cfae2864184eaa29eee9c8cd267c6e4c7aebbe811209fb579724bf95714bc5a4a89e9d908e9e8bf35709d85f84421f744465421c72b8
SSDEEP 384:sxZGrmWn/f0siWo16T/+HbMOA/RRIBoA8dvTuIn6vbwMtkWs:surmWn/fqWPSHbURRIsTTn6v7tkd
TLSH
T1B4C27497B0780A7A4ADD8532F025FF39D79104278EA54EC7AAECC92E21D79FD7500C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 edbf1a0e2a1be81b0e056dcc48039edfa6230f3dd51b6577f6def9c521c1c70e
MD5 50cd775b6515c1c5e66555f519645ff8
SHA1 2435a3777262e9ba43be4e0d73785d52b72aa45e
SHA512 84182c8b0bd5027b8c8c5ead929900de2f2ddcf875f8e67998bb39ffbcb288040a6720552df12b1b4bb4de764c954a90fce38e237b6cc1ff581bf95b570772b8
SSDEEP 192:sxZGRTFcBzn/f0sI/O9N/1Xbo/QdpmThi4BHW6+WNZrBxeylqHTM/zjrVTVFIg5S:sxZGrmzn/f0sOW/1UI2HbMlI/NA
TLSH
T199520746B924593B4CD7D229BA15BF53E7F91032C5815E89E6FCCA1C08EA7DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 142fc5abaf64fcd1bf5bf2c6f7123685ef13a49741f81c4eb3854ffaa958b8a4
MD5 04c515f7316266a7adf85da71f9d7ff3
SHA1 971a5c77784e1494e2f932787572b98e44399853
SHA512 c2096c8c81bfb8af5a32e8a037a8283ca5bc51031d47492d49170691c8a0a34e8e8a962e8ce661422d9ac7da29fed1cb36cc46eba07fb4b954e5bcab23cc9a77
SSDEEP 384:sxZ1gmWn/f0sUWi16T/vHbCLZ6/RRpyBoA8dvTuIn6vb/MtkWs:s9gmWn/fsWVjHbrRR8sTTn6vItkd
TLSH
T132C274A3B0780A7A4ACD8536F025FF39D79104278EA54EC7AAECC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 bc4e7b590ddff920ac54035c0c3b7187e15a1401a96e3979a3bb2c299c790ed9
MD5 a5559f05b4f7cbedc318fead63fb01c6
SHA1 6256774454adb21c681ff07a74354bebbd033df4
SHA512 248d45e8dc2b5486c5e04cb568df5e563b7a6d72f9f74acc8b122e47aa4035098ecc42d4d4dfb4a3e58df710bac37a0faf2dff598159c0f0d6ec2451305319a4
SSDEEP 384:sxZygmWn/f0saWi16T/vHbSAIZ6/RRpyBoA8dvTuIn6vbOMtkWs:sqgmWn/fiWVjHb/FRR8sTTn6v9tkd
TLSH
T128C28493B0780A7A4ADE8536F025FF39D79104278AA54EC7ABECC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 9b3f301ebce08f4c68fdfed8052618d843ecfe2bf2c1c8330112751d346ac75b
MD5 f51c1191373dad276de27b59e6fa02ec
SHA1 453aeee4a923ea5868b34725f71f86adfdbf7fea
SHA512 5fcd1ccd9504173cc62dd270066773ddf6152e8bfc50811e4acf258da4271933cb8e591fb2284bd2c47166843b0d5868883662b0227c99720145615a7f8d9ae4
SSDEEP 384:sxZGrmzn/f0siWo16T/+HbMlI/LRGdvkOwnfFStkWs:surmzn/fqWPSHbnLRUkVnQtkd
TLSH
T19492B6977078597B4DDA8636F421FF3AD7E004238A954E8BAAFCC91D11D76FD2101C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 8b93e043127dc9dd9f09c27fe3f10d78a722598d4faf4adcfb8eac1a3538b167
MD5 f01b6b0f988a3a7c07cd9bb6095f5120
SHA1 b1a4ab4ecb77274fc8f0feeb33ad4fcb70c061f9
SHA512 2ddd52659db0209d44e5381dd6128cd973f574b171248d2195286917647e9131adf27467b1229d40771cdd515248e03140e40151448e118de44cbd3cfd6d1367
SSDEEP 384:sxZygmWn/f0svW616T/PHbSAIlE/RRbBoA8dvTuIn6vb/MtkWs:sqgmWn/f3WNTHb/jRRbsTTn6v4tkd
TLSH
T172C28493B0780A7A4ADE8536F025FF39D79104278AA54EC7ABECC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 e69d50f151b15999bd3e39b652a514aa9e5c892f9619cbf811c67c635c1081e9
MD5 d7cbf7d3be6aec95bf273fb359145aac
SHA1 b015bd32bfdf8d6777e7aad4a11a89a313401073
SHA512 401a363abac378857bb27e572b96331b9d463bd3b4fbb1a8b1c20d772e25c8f70505fe37200993719b64241cdfe2b231178b2e3dd990fbfaa530945631a16bf3
SSDEEP 384:sxZygmWn/f0sMWNH16T/VHbSAIlE/RRbBoA8dvTuIn6vb/MtkWs:sqgmWn/fUWqBHb/jRRbsTTn6v4tkd
TLSH
T13BC28497B0780A7A4ADD8536F021FF39D79104278AA54EC7ABECC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 186ee312173ce5a8ef7afbc93788a70d7a68a927807d0ce4547f361cff2883d7
MD5 8517ff7f536fa22dcf8f00cac428dc24
SHA1 deeec0315210ee682a0b00139213e2aba2b45012
SHA512 6cbf47ac8092a33c4c612236b38ea26a77d18fe16b8b57ca1959da855b4f9d4d14c4e1efaaf6bb7b3e0edb5b94c389d0bf3b775937cb6ead1bc1f4f44009233d
SSDEEP 384:sxZyrmWn/f0svWz16T/WHbSAItY/RRbBoA8dvTuIn6vbfMtkWs:sqrmWn/f3WYKHb/rRRbsTTn6vgtkd
TLSH
T1D6C28593B0780A7A4ACD9536F021FF39D79104278AA54EC76BECC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 41KB
SHA256 4e8b8d51c3203e41b9997e77be4382c2b77925dd0035e724776d19f70af7dd32
MD5 97e930cfc39c847fc23868b7179e0fa7
SHA1 dc45c8dd6a7c30110eeb9554529b6ecd6775dbef
SHA512 f9ff5c8a45e55cc3900b0aad14474c984e45007bc12ebfa37a1c81fa70df9f12dc222cbde1f4e4103d924f11bb55bba99aadd23b55848f39a07bcdf9368d537b
SSDEEP 768:sqrmWn/fB4Mnc7WeT+vSWYKHb/ZRRbsTTn6vItkd:nrmWyMmW1SWYeBwTTn6vItkd
TLSH
T18B13D793B038C97A46CB4D35F038FE3AD78404678A95CEDB6AECC91D11DA5FDAA01C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 ae213d8b21c585ff4e34f2c75b9092d6d9a5e45804cfa428690aed8df9821fc5
MD5 5f4aba95629fe55b832e53da35dbe667
SHA1 b2f7b24e995b6e2ca182f71aedb0b9eeb45bcbc7
SHA512 f0ad0958b9f95d7319b85d3e27999979677d80dee8eb8047c17dade684bc752dccb3ee6f5e3cccdb7bfdc1651ac7d74f5a527b85b83ce38055af13e77388c6a7
SSDEEP 384:sxZygmWn/f0seWH16T/sHbSAILQ/RRYBoA8dvTuIn6vb1MtkWs:sqgmWn/fGWEgHb/LRRYsTTn6vCtkd
TLSH
T1F0C28493B0780A7A4ADE8536F025FF39D79104278AA54EC7ABECC92E21D79FD7500C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 970d9111a7ac6691e09cc49709d00e42c67c2c36f970f8e5ffb2b9cb27216ae2
MD5 f470bde338511ab9e74fa9f462032353
SHA1 9625a3c55443b775b5c9eafeb40925fc25395153
SHA512 ab7394c0235b7942b1fec1be3702f06af8dee79a3ef440d35315e40f64c53a88e77a46ef8c1bdfb81364cc64ca67ba72425b90921b0858155383bf9667c88349
SSDEEP 384:sxZ1rmWn/f0sUWi16T/vHbMZ6/RRpyBoA8dvTuIn6vbSMtkWs:s9rmWn/fsWVjHbJRR8sTTn6vZtkd
TLSH
T178C27497B0780A7A4ACD8536F025FF39D79104278AA54EC7AAECC92E21D79FD7500C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a0936aafb8fc1fa1a14c5bccd4ebf7dc9f3cac1523296de94a9577dfba3ae750
MD5 96bf9244b8d5bdbc7146bc7688adda00
SHA1 7727ce70a140a78e0725ebb85f8563d7aa079d50
SHA512 54f1d89df0bbb88a73a8fbcfcea62bf57152fd1575ff28ab9199e7360b49f62d7978edf33ddbae0edadf104c62d6cebbc19eb72b6443329cdfe341b4ce7cce29
SSDEEP 768:AZa0JXQ7pLuLbT3Wv/xJ98F1+UoAYDCx9Tuqh0VfUC9xbog/OVxmHmLlEy3z4roA:AZa0JXcEbT3Wv/xJ9u1jawmHmLKAzDA
TLSH
T1E3E20B7B384CCB7E4FC00A9DDD2A7F8A6DA8028B9598C98047F9945C02D77EE51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58b4427a-4331-416d-909f-51df395786c4\index-dir\the-real-index
Size 72B
SHA256 3fa05cbd3fb264c3a855a29480d9e72411839a8c2e7cc32b5f8916b1bcf2d321
MD5 2e48e494a95fdcb88079b4075e2ccf35
SHA1 acf94b7611afbc106e739a0a227d1ccad18c7b43
SHA512 6102e37e114da5da61690f3f87855807364aa7ed3d390eb9ab66e1a214ad16ccd18db832cc3d9a969ccd5062badb81300d11ffb1ae42ee885c7f68e0e78c61d2
TLSH
T19CA00212B6C11A0FDC018AB0A09211766314D9358F15929A49E011A8E8FC2604705440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a21b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58b4427a-4331-416d-909f-51df395786c4\index-dir\the-real-index~RFe5a21b2.TMP
Size 48B
SHA256 1b21604fcc5497040b9666dcbf49c075f0e1d1bceb39b70920efba755eca129e
MD5 b7fc842138a5ad3400ee591920ece802
SHA1 45771c68388bdd9a3ab8290ef5c855698d07bb00
SHA512 e244e81873a54904b0ca93d1ee91d4ec4545a52fb5f847a999af8c0ae4fa39394a18fb10c194242db969525b8ebcc114c09e7fa53d76af58c288fa2a7512644a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9d911c0-f3ca-4ce2-9039-0e30e66bf529\index-dir\the-real-index
Size 72B
SHA256 896fe8f696f8af6629bab9efddb31f80abb604360b737b8eee5582ee0f0e91e8
MD5 342cc08b4e846313f6d3cdf22734e721
SHA1 df7cf38ed1797dc777e0c96508ef3aa97a4bb3bc
SHA512 316bebb6cb7554327767cefb8de1de091ec984b509440e091797ba3c899b0bf70208fe71ba9f650006496863fa74226bc78725861382e9f629ac3dc3c162e005
TLSH
T102A002144A870442C14263B1369622B16360DD544241275762BA2084DC7E9454D5284D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9d911c0-f3ca-4ce2-9039-0e30e66bf529\index-dir\the-real-index
Size 72B
SHA256 c2e4111e9af8c8a7f6eff5ee846257c8bab33a5a30bc80336e3ee7ce16bdeec3
MD5 f98356daa97be539d45f5253113af920
SHA1 189ab6cddddf29182fc4ec257762c29f5ab9ad04
SHA512 8f2285c7a78b56af51f39fa6016a5ded4f6005d6263a02ea8e1965853f27ab8c6fe00f31f063d7382252f843ef678ba3ce344ed08bc4d414d26b9d29399f5a4b
TLSH
T1C1A0021023C0502AC41215B3255302551B11C8501140274B54A98244CC904414D4120E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bdf30671-8e9c-4deb-bae0-a7d53dedeee8\index-dir\the-real-index
Size 1KB
SHA256 7e33cfda59ab70141a7a00a9cb52b43f6bf8ede309d99db1f7b7cdb0a89ae64a
MD5 c888f3a8fa2e34766dc00b97f6cf3f61
SHA1 74ebe5687ad01debd0dfedddaa6a9cf4098c4767
SHA512 97ceaffbb4291b7450c426f609500bfa7de030d29dfffe65c828b4f22f6337ef448bc893822174e2e8f661724e60aca6245d346a364a92e0c53babf0337066b1
TLSH
T1F331D84A8FA20F8BDD9466B01439685A7334A2CC1304760F92FEE23EBCD2744ED4688C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bdf30671-8e9c-4deb-bae0-a7d53dedeee8\index-dir\the-real-index
Size 3KB
SHA256 cbd1583cf37121c298114a7c245c1d1471ff7762b61cd58ec201f9965b7cdb28
MD5 f6402e7fa821056f378a8cfa9bc33b2a
SHA1 868372e5c8e022717dd96f36778923f66fd5795e
SHA512 da17fe62f7bb46174e60cebcc62508ead4424edff5c3e9bf64e91f2c7463da4353a77cb1495b06ae0d5f1dd199a103e138fa1d5f5c53bca6bb613d4531bd34d0
TLSH
T16651E74E4D078B6AEDAC527108B51894333429CC03781A1FA9FE8138F8C3B681985BA9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59af22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bdf30671-8e9c-4deb-bae0-a7d53dedeee8\index-dir\the-real-index~RFe59af22.TMP
Size 1KB
SHA256 334c374fa3bcad89121bd555fefe71f38d16324983bff2a6b188f3490fae4f67
MD5 64f3bb9711b43064fa6ed869c757e69c
SHA1 3c0bc6d05f6f805548811337406486941ff46c78
SHA512 6fe5f36b3da71c4658e432a8ded4ffeeb7610f5338ab38b6ba5725087fdb21c9f533c3d8560450dd2abd424e449fd45a199cc166bb3b813ed91b05497e7aad3c
TLSH
T11F31655715B21B67ED4022F6186869D63339D1480348771FA2F6E13AAC80B84EE9A988
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 479B
SHA256 a1c7574d5b859d74aa6120e0c0c9a80fb8d312ee224d77d81974559099bf041b
MD5 560d88befba96cbc59bf58a4b82e828d
SHA1 5e8309c0239df42b026fbdb55af5d6352dccdeff
SHA512 611f967744d7471ddb2cb6859c92e9a756c43e33988c7bb15b0968dfce7d1784708f574a031174d51fb07314d051c83ddc2c43c533fc38a856b8ea09c47c4679
TLSH
T172F027B26EF70814FCAE93DAA430045100157D44C921BD0E2123B1ABE0B1329A469CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 cec4b9062b34c21deebca4c6e0227fec7d0583c852dc65e8f3d7143bafbb2dc1
MD5 2a5dd56ec16e6315cc1d60c747929447
SHA1 8ccd0055fab0e1d80b3c71fd4c7af9c0e3084101
SHA512 0e785be87d93bde9ce2e2994fecc0184aa49ef4c8747d3c0c49cd3859816e29b2209c30b74822dc9ffc2e4f88aac564314ce2685f2e8ca3798a552e6d3882b1a
TLSH
T120F055B32EFB0810FCFFD3EA6430042100057948C920FC4F2123B1ABE0B1328A4AACA3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a12570a5b7fcf7df335e7c03976553e320a4b163ee90502bd5c8c9487e6e40cc
MD5 f149299ab84b568a063938689f330d39
SHA1 306242b923f328308949b0928a3ff20000247e38
SHA512 deb8274a31f9fa9322f32aa5aa68a270e53d9d458cb09b6e30fe622aa6f7eb51680b2331094d2443b034f28e127f1eb1ee5f764da84cdb7e41473536bce58238
TLSH
T1FDA00279CD549242C450127490A60BEC6230889C0A052326C1ECD1FAD8515405192405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0214.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0214.TMP
Size 48B
SHA256 ddea4622d2c5c33d58a2cc4ff1f2e46e4cf8ea00e5d475cff323632a3c74df42
MD5 8f4b4a35062375e478857dd340df304a
SHA1 0fa81453f9641564b72aa7c5910712a75f4cb039
SHA512 dedd75c1de69ebfa7601a1ddd990d7535b938069ae15b6b87583f901133adcaff6fd502be78a78ac974e87c2610cf68b2eaf4730a2481c9bb1919971c6085d96
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4941c6df5cc7bcfddcd2aa7002da84b59c545b7b261d20d67ae5f0f1a394353c
MD5 07a9e193f4284a287fa53ac3d9c643c4
SHA1 e5d7f10ec3a1c278ecea7929a5f4e36e16aa910f
SHA512 47bf0b01a9c71990f025c730da801bae76fa51017bab164df3e3895ad3a3f999cdd5331aa3d061c7ebaf7cf18630d5d216163d7302d501badcf369558b81c5f4
SSDEEP 96:KMC4K3Kub4IKRWe+dURNfLXknLWPxFkKZBx3k1tN2fj:mr8/+dURNfLXaLWZF5Bx3qtN2fj
TLSH
T1F8913344B1FB1210387E291C82709B9E464132B73478EA6F7F7C0192DE66E081EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5a56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5a56.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 a2fe488446ddd2d542bb159d62674474d6d8b2ff3b89b21ccb4ebc5ae9b51b66
MD5 ca1e6f806e8ecea41d4a5fc8a25df021
SHA1 629a62a25595abe97f85b19fd0c747729fbfa9ab
SHA512 e509b9bb8b514c905bc3f888a63c7c87c0e4763a97bb6aaed021126c0e19ff2507ed194954b68ca59a9b1170c4b450778d773fc8aba237c0abd6c2da7a706039
SSDEEP 384:nmiFiZcI5HsNY8TUNTUlIlkmTGTKoHZzHig3DfcCuOovusd+fuCuJGsa+VY0d7Uq:NFQJRwgQ2uICnY1dsUMhgrt3
TLSH
T10BD2B5F598D79836E8AE5783A73E6E528DBCD06379885984B7C85D0CCC862BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bca679bb45fff86cd37983997b912f39212695b162ac783e18148ba445bb166e
MD5 7684224b3181aedb49705bc969503b81
SHA1 8d255552b4fbac04f255fa07c2cb8a34233d3f01
SHA512 0c94baf8a09700fa9da4a9644d5320d8004d1c8a740ec371567a9837a1c06beff4f424c7f92b58058f8b3c52b36ebfbb35b383ddd1240febf7fefbddd578efd5
SSDEEP 192:WON16L1QmiUyxbNqMgmSuOoqzSus6Hc+mxvJ7UxU6:WON16fMNqMgRuOovusd+KJIxU6
TLSH
T10102FA79AC686C778EF3AE45B1877B235EA4203BBA812F44C5E81E1C10D765C3306D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 038078464098f1148ea15c6b2fc9d6be95a24cdb2638f34cdc3f0b55fb5cfc58
MD5 24bdf08c520b4ae32cc6b848564415ad
SHA1 61b80ed7bb08e15a0a6b528868355f7744a1f98d
SHA512 8153c5141cb11db5e28ea5ba10561c91e45452bbc86186f91300abfeebf6720067181a52b0ead5e70c78c7f447eddeb679d279b370bbb8fc555b055af6769e62
SSDEEP 384:nFZcIqsNoknTTKoHEwHugMuOovusd+fuCuJGsa+VY0d7UQoA:9qW2UwnY1dsYMhgrt3
TLSH
T18F827DB56C78AC7258E7A651F68B7B138EB420776DC52F48D1E99F1D04CA398330AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9cab92804375e2f467207725c3f1b12d50b5370cda609c4286b0ca9e039a7d4f
MD5 0cf0440ea570c42f564c90354220fa18
SHA1 b813fdc8fcbe226a9ffe2e5f1e94d1f6e01e4978
SHA512 ca2028d16e13d2b727f6ede76634588a375c1a34a17bb163f31261ea874b34911e8fb7a704e71c50773d024400410d8b00c6eeda741bddd6fb068f9873e37b3f
SSDEEP 384:nmiFPZcI5wsNs8TUNTUlIRAmTvTKoz07Heg3ffBCuOovusd+fuCnJGsa+VY0d7Uq:NFHulwgV2/lCnY1dspMhgrt3
TLSH
T17DD2A4F598D79836E8AE5783A37E6E4289BCD06378885984F7D85D0CCC861BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d1cbe7c876fd4d36c2eb701a9f6dc43539a842d6ff5d36c6c6362df327f69959
MD5 e8e0e09e214801776c22ac3e50dc8584
SHA1 6e605575fa174982592e80083ef055163c4a4f00
SHA512 ab5f6baef3a40dda60905387131371631a46276406574a5d63a79ebdc884e08430488f1212c03c3e52c3d55af4a69cf0014f70804420e8ecf24fd72ec9258603
SSDEEP 384:nqZcIXsNokmTGTKoH94HigMuOovusd+fuCuJGsa+VY0d7UQoA:IXq2VknY1dsYMhgrt3
TLSH
T1AF827EB56C68AC7358E7A641F6877B138EB420776DC52F48D1E99F1D04CA398230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 837360a71d7a7da368b9cb3a226a18ed1dbddbe11976568f60ae013e9ddfb7a9
MD5 3a2254a3145920de1b48042bd75f20ae
SHA1 da3f0b845aaeb86783bf772c90b45e6ecaceaff3
SHA512 900b1330af9399a809d62a7d5c341376858faeaa4a1cef63aa599b6fcbfe18b87c0084334566db886e2b59168d47b0488cf443491a12b3f9f9606f746c1d7327
SSDEEP 384:nmiFUZcI5wsNs8TUNTUlIRAmTvTKoz07Heg3ffBCuOovusd+fuCnJGsa+VY0d7Uq:NFSulwgV2/lCnY1dspMhgrt3
TLSH
T18BD2A4F598D79836E8AE5783A37E6E4289BCD06378885984F7D85D0CCC861BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 425afd9bdf2779975fa1fb5bf80e7bf29644b338497afa600a0dae5cc0dabca1
MD5 29ee5140787b86d81593c3161a967cf4
SHA1 a29d26817bfb7c2891ec6d42a5bc9d2a467a65be
SHA512 2efa3a502ad9b26883928aae94809d96c472e9b0cf689396424533529e6064f658166dfffe035dc886c0f3e28553fcc13418a7f9b9770586a7108661eea9e4de
SSDEEP 192:WONp6L9QmiUyYbNqgmSuOoqzSus6Hc+0SuCFF0JCr/i8U6:WONp63vNqgRuOovusd+fuCsJGU6
TLSH
T1901208B5A82CEC335DA37944B28737639EA52037AD856F88D5E81E2C00DB35C3709C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 634a7c1466fe18cef2918c36ccb65e51bf5c50b9b988f4b4754c92467f6a718d
MD5 1d368ec152be48467c6674f6011df83b
SHA1 498dff5a9f77496e58e66d123531dc3f1651ac6c
SHA512 f927120cf348af17929ca9107c6191aa3f0261ef94cf4dd7a09e3684976bf79151ec5ddef47e1aecb002f25675e0db561c636bf5eea4b97e6f6b8bddaed2dd7f
TLSH
T13FE0020BD35155EAC53413741047572137E3E57042720346AF1005663D533101F20BD2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 30c044860bc3b0517a14b7e3a976e7804f0c577c14dd6d34af7000aaf770ba4c
MD5 fdd9b7dbfd83e27f2795df072db5ea58
SHA1 e755c5eb62e655c19df2385bc7e23a8fe8e02ef9
SHA512 3301827853aa7cb4adc94ebc83343609fe0cd9ee0d0657838ed5bb9869b33cb84871fa0b3f99a23f5d828a037c83ab4a82cef1816dd65952b17dd902234cb894
TLSH
T128E0010BD35155DBC538137410875B213AF3E5714B730746AF20057A3D633102F21BA2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e0d01010c8720a1e4eb2c9586546ff591e40cd315033ba02faf890af6fc6cbd
MD5 9f3f8fb465c49abb7759fb93ba5c4f36
SHA1 f35cc19659f2928955f373dbde9e4361cec1e5c7
SHA512 5ff5d490991fc3d512d7844e29d8d1d08dcee5037d110c9df03c1f4bb3348706088cbcb5bc2e90790d33ff34709e469031d28253d13e71f065cf2d6b204963c2
TLSH
T124E00207535105F9C43813300043532123D3D57001B20346AC0005511D032100E30F91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 65236858c933fc8751492e960fb1aef2148f72234500475e43d806136eab9ecb
MD5 207e7cc438b3f01a291030bff186b0ef
SHA1 46c83a525f0494eee25db4f2a1edb7643dbf8b60
SHA512 e3a528a2308d1955b30519b65151ccbfc5d12631111aa523b49f8bc5771a0de7eb4292f30972a041057de04d042e851802a8dfd5b5dfac737c28d8dfd5d19068
TLSH
T17AE04807830114FAC0AC037011874B253FE6D0700AF30B039F20006D2CA33003F31D62
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 65ce2f792861f1c5f229b2f8ea2980f47b9bac1b2a9f7710b61b79bc33c8b7ad
MD5 df350ce325320b26f44bc85bfd0ab0d7
SHA1 85162f79f6fc3bbfa60c9a35fb2fe3745a637319
SHA512 31bc6d82ec0414c73232ebf6664cd428903370a04978b6163e388136733b71a4009bfe4fbff89c82c8da2dd0925a58764b78ad8f8cf96699bcd1a58945e51644
TLSH
T1C9E09207830114DAC068037010874B242EE3D0700A730B025F30006D2C333003F21E51
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 323ab2c7e9a944ceb0a7169e8bf14ee73e9c4365b4a745166dc606f711cd1d50
MD5 77a061a10703af62217c85912af3c79e
SHA1 bc37b1fcf032e8d8c5731a3d0191df76fb634a4a
SHA512 e4081a013b7453973077fc52699caea14156c032d214cb1a1f52f1e01288780435ef6686cffccad1d3c620baf581285e56fa012e7830ebaa49cbfffb49c94c72
TLSH
T16BE09207830114EAC46C037011874B253FE3D0700AB30B03AF20006D2C733003F31E92
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74187c71dd15c3a2416160bdad9d1d1bae6de20c318972bb0510a0e508f1269f
MD5 3de9a713d5c496a9d73c98e897a5dbd1
SHA1 2d969d4b523dfb296726c9ee95109838c9c2d4a9
SHA512 49cb9cb2430100830d453b85cad6399b3845120a85e47c5a825ffd1ebffeda16b00c1484a721b39b143531a92680506de7e39fcf71df15fc3f16c1b8cc538975
TLSH
T150E0090A935259DAC56813B4218B9B296EE2A5A14A730B46AF2005AE2D633113F21AA2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7f7537f05b7eabe06e808161a0eefe82e61a228148abd8bb2341565031d3c0b7
MD5 e7a4b8633ab9074e73857c1a23a8dfe0
SHA1 c7b323b2b5f73ccec76dbc2d102cbbaf5491ae11
SHA512 f9e5cd12760e181e322c6d62bef9b144abb58fa95a27df1ecc348a3774d32d305b09253497661236b02e13a0bd2fd6407e1c4ece4b4e4999414bfdff26b74732
TLSH
T1B0E0480B834505EED0A8037012C75B362FFBE0B40AB30B02AF20026D2CB33043E31E22
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59c00a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59c00a.TMP
Size 392B
SHA256 7129a89d257c7673e42fa75b87d180999bb3244b40ff31556ae193b4ac289593
MD5 f79ed1e9b40a25e0f760842dd260026f
SHA1 1efffa864c522d7ea4c80cdc92078cbd8ef33f0c
SHA512 004c7f7d2c8727094de66be8c6760ce3a57ad7761e6dcbd065cf0232bd1f8797c8f4099e07d31a2bc5eb9d3db6b30d3ee1fd2752dca70b0e0891dd82b4000d01
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b9f847f4c0c20e5bac3c180b86df95959be7c82f21cf8ffa34408d5a1c756fc
MD5 6dcecce551ec4837ba91634384c9af3a
SHA1 4c24eca1e83526e34616475f7f721d3b642a5b34
SHA512 04ce1d433b7f75acbc9233be09a63288a03eac2c6a68dc3ec7356f9d62b2ebdbff73d97398614d9190eb36400cbe091982f997dffa05b7757804db69b983a752
TLSH
T16341D85CB7FA1158B373AE5AABF3686D487BBD772E0AD05D00110E4E4A73A40C862733
MD5 SHA1 SHA512 TLSH

Submit Download

25d2a4e9-3b0e-4f40-9e10-439709b3f6be.tmp

Path C:\Users\Admin\AppData\Local\Temp\25d2a4e9-3b0e-4f40-9e10-439709b3f6be.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3320_50087613\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1212992354\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5064-18-0x0000000022700000-0x0000000022701000-memory.dmp

Download

memory/5064-20-0x0000000022720000-0x0000000022721000-memory.dmp

Download

memory/5064-76-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/5064-61-0x0000000022820000-0x000000002285E000-memory.dmp

Download

memory/5064-52-0x00000000229B0000-0x0000000022AA4000-memory.dmp

Download

memory/5064-53-0x00000000227E0000-0x000000002281B000-memory.dmp

Download

memory/5064-60-0x00000000227E0000-0x000000002281B000-memory.dmp

Download

memory/5064-75-0x0000000022820000-0x000000002285E000-memory.dmp

Download

memory/5064-38-0x00000000229B0000-0x0000000022AA4000-memory.dmp

Download

memory/5064-33-0x00000000227C0000-0x00000000227D2000-memory.dmp

Download

memory/5064-37-0x00000000227C0000-0x00000000227D2000-memory.dmp

Download

memory/5064-32-0x00000000227A0000-0x00000000227BB000-memory.dmp

Download

memory/5064-28-0x00000000227A0000-0x00000000227BB000-memory.dmp

Download

memory/5064-27-0x0000000022790000-0x0000000022791000-memory.dmp

Download

memory/5064-26-0x0000000022780000-0x0000000022781000-memory.dmp

Download

memory/5064-25-0x0000000022770000-0x0000000022771000-memory.dmp

Download

memory/5064-85-0x0000000024F50000-0x0000000025A4B000-memory.dmp

Download

memory/5064-19-0x0000000022710000-0x0000000022711000-memory.dmp

Download

memory/5064-22-0x0000000022740000-0x0000000022741000-memory.dmp

Download

memory/5064-24-0x0000000022760000-0x0000000022761000-memory.dmp

Download

memory/5064-23-0x0000000022750000-0x0000000022751000-memory.dmp

Download

memory/5064-79-0x0000000024F50000-0x0000000025A4B000-memory.dmp

Download

memory/5064-21-0x0000000022730000-0x0000000022731000-memory.dmp

Download

memory/5064-15-0x00000000226D0000-0x00000000226D1000-memory.dmp

Download

memory/5064-16-0x00000000226E0000-0x00000000226E1000-memory.dmp

Download

memory/5064-17-0x00000000226F0000-0x00000000226F1000-memory.dmp

Download

memory/5064-9-0x0000000022670000-0x0000000022671000-memory.dmp

Download

memory/5064-10-0x0000000022680000-0x0000000022681000-memory.dmp

Download

memory/5064-11-0x0000000022690000-0x0000000022691000-memory.dmp

Download

memory/5064-12-0x00000000226A0000-0x00000000226A1000-memory.dmp

Download

memory/5064-13-0x00000000226B0000-0x00000000226B1000-memory.dmp

Download

memory/5064-14-0x00000000226C0000-0x00000000226C1000-memory.dmp

Download

memory/5064-2-0x0000000020D40000-0x0000000020D41000-memory.dmp

Download

memory/5064-8-0x0000000022660000-0x0000000022661000-memory.dmp

Download

memory/5064-6-0x0000000022640000-0x0000000022641000-memory.dmp

Download

memory/5064-7-0x0000000022650000-0x0000000022651000-memory.dmp

Download

memory/5064-5-0x0000000022630000-0x0000000022631000-memory.dmp

Download

memory/5064-4-0x0000000022620000-0x0000000022621000-memory.dmp

Download

memory/5064-3-0x0000000022610000-0x0000000022611000-memory.dmp

Download

memory/5064-0-0x0000000020CF0000-0x0000000020CF1000-memory.dmp

Download

memory/5064-1-0x0000000020D30000-0x0000000020D31000-memory.dmp

Download