hxxps://www[.]mediafire[.]com/file/uylbt6i0u38tncy/BrModFinal[.]rar/file

Analysis

user interaction
yes
max time kernel
184s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/uylbt6i0u38tncy/BrModFinal.rar/file
Sample260930-we5gwaed53

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	DoubleRunTimehost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	winrar-x64-713.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
6328	winrar-x64-713.exe
6220	winrar-x64-713.exe
8128	uninstall.exe
980	WinRAR.exe
5504	BrMod2.0.1.exe
7628	DoubleRunTimehost.exe
2960	BrMod2.0.1.exe
5512	BrMod2.0.1.exe
4980	BrMod2.0.1.exe
7800	BrMod2.0.1.exe
3460	DoubleRunTimehost.exe
3908	DoubleRunTimehost.exe
5032	DoubleRunTimehost.exe
116	DoubleRunTimehost.exe
7092	DoubleRunTimehost.exe

Loads dropped DLL 2 IoCs

pid	Process
3220	Process not Found
3220	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240804375	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DoubleRunTimehost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DoubleRunTimehost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7424	ping.exe
6268	ping.exe
4764	ping.exe
6444	ping.exe
3144	ping.exe
7996	ping.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4388	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
7996	ping.exe
7424	ping.exe
6268	ping.exe
4764	ping.exe
6444	ping.exe
3144	ping.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
8140	msedge.exe
8140	msedge.exe
5504	BrMod2.0.1.exe
5504	BrMod2.0.1.exe
7628	DoubleRunTimehost.exe
7628	DoubleRunTimehost.exe
7628	DoubleRunTimehost.exe
2960	BrMod2.0.1.exe
2960	BrMod2.0.1.exe
5512	BrMod2.0.1.exe
5512	BrMod2.0.1.exe
4980	BrMod2.0.1.exe
4980	BrMod2.0.1.exe
7800	BrMod2.0.1.exe
7800	BrMod2.0.1.exe
3460	DoubleRunTimehost.exe
3460	DoubleRunTimehost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	7628	DoubleRunTimehost.exe
Token: SeDebugPrivilege	7628	DoubleRunTimehost.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
980	WinRAR.exe
980	WinRAR.exe
980	WinRAR.exe
980	WinRAR.exe
980	WinRAR.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
6220	winrar-x64-713.exe
6328	winrar-x64-713.exe
6220	winrar-x64-713.exe
6220	winrar-x64-713.exe
6328	winrar-x64-713.exe
6328	winrar-x64-713.exe
8128	uninstall.exe
7628	DoubleRunTimehost.exe
3460	DoubleRunTimehost.exe
3908	DoubleRunTimehost.exe
5032	DoubleRunTimehost.exe
116	DoubleRunTimehost.exe
7092	DoubleRunTimehost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3776	4320	msedge.exe	85
PID 4320 wrote to memory of 4388	4320	msedge.exe	86
PID 4320 wrote to memory of 5896	4320	msedge.exe	88
PID 4320 wrote to memory of 5860	4320	msedge.exe	89
PID 4320 wrote to memory of 5896	4320	msedge.exe	88
PID 4320 wrote to memory of 5896	4320	msedge.exe	88
PID 4320 wrote to memory of 5860	4320	msedge.exe	89
PID 4320 wrote to memory of 2164	4320	msedge.exe	90
PID 4320 wrote to memory of 4476	4320	msedge.exe	91
PID 4320 wrote to memory of 2164	4320	msedge.exe	90
PID 4320 wrote to memory of 2164	4320	msedge.exe	90
PID 4320 wrote to memory of 4476	4320	msedge.exe	91
PID 4320 wrote to memory of 4476	4320	msedge.exe	91
PID 4320 wrote to memory of 4268	4320	msedge.exe	98
PID 4320 wrote to memory of 4268	4320	msedge.exe	98
PID 4320 wrote to memory of 4268	4320	msedge.exe	98
PID 4320 wrote to memory of 1884	4320	msedge.exe	102
PID 4320 wrote to memory of 1884	4320	msedge.exe	102
PID 4320 wrote to memory of 3372	4320	msedge.exe	103
PID 4320 wrote to memory of 3372	4320	msedge.exe	103
PID 4320 wrote to memory of 400	4320	msedge.exe	105
PID 4320 wrote to memory of 4968	4320	msedge.exe	119
PID 4320 wrote to memory of 5692	4320	msedge.exe	120
PID 4320 wrote to memory of 4196	4320	msedge.exe	121
PID 4320 wrote to memory of 3076	4320	msedge.exe	122
PID 4320 wrote to memory of 3100	4320	msedge.exe	123
PID 4320 wrote to memory of 3076	4320	msedge.exe	122
PID 4320 wrote to memory of 3100	4320	msedge.exe	123
PID 4320 wrote to memory of 3100	4320	msedge.exe	123
PID 4320 wrote to memory of 2020	4320	msedge.exe	125
PID 4320 wrote to memory of 4744	4320	msedge.exe	126
PID 4320 wrote to memory of 4744	4320	msedge.exe	126
PID 4320 wrote to memory of 4744	4320	msedge.exe	126
PID 4320 wrote to memory of 4168	4320	msedge.exe	129
PID 4320 wrote to memory of 4168	4320	msedge.exe	129
PID 4320 wrote to memory of 2020	4320	msedge.exe	130
PID 4320 wrote to memory of 2020	4320	msedge.exe	130
PID 4320 wrote to memory of 2020	4320	msedge.exe	130
PID 4320 wrote to memory of 1080	4320	msedge.exe	131
PID 4320 wrote to memory of 1080	4320	msedge.exe	131
PID 4320 wrote to memory of 1080	4320	msedge.exe	131
PID 4320 wrote to memory of 2844	4320	msedge.exe	132
PID 4320 wrote to memory of 2844	4320	msedge.exe	132
PID 4320 wrote to memory of 2888	4320	msedge.exe	133
PID 4320 wrote to memory of 2888	4320	msedge.exe	133
PID 4320 wrote to memory of 4640	4320	msedge.exe	134
PID 4320 wrote to memory of 4640	4320	msedge.exe	134
PID 4320 wrote to memory of 4640	4320	msedge.exe	134
PID 4320 wrote to memory of 4192	4320	msedge.exe	135
PID 4320 wrote to memory of 4192	4320	msedge.exe	135
PID 4320 wrote to memory of 4192	4320	msedge.exe	135
PID 4320 wrote to memory of 2268	4320	msedge.exe	136
PID 4320 wrote to memory of 2268	4320	msedge.exe	136
PID 4320 wrote to memory of 2268	4320	msedge.exe	136
PID 4320 wrote to memory of 4204	4320	msedge.exe	137
PID 4320 wrote to memory of 4204	4320	msedge.exe	137
PID 4320 wrote to memory of 4204	4320	msedge.exe	137
PID 4320 wrote to memory of 2208	4320	msedge.exe	138
PID 4320 wrote to memory of 2208	4320	msedge.exe	138
PID 4320 wrote to memory of 2208	4320	msedge.exe	138
PID 4320 wrote to memory of 2404	4320	msedge.exe	139
PID 4320 wrote to memory of 2404	4320	msedge.exe	139
PID 4320 wrote to memory of 2404	4320	msedge.exe	139
PID 4320 wrote to memory of 3824	4320	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/uylbt6i0u38tncy/BrModFinal.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffadd57c188,0x7ffadd57c194,0x7ffadd57c1a0
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,6209471328918659558,17999039637827405167,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,10402961688980120882,1741859091699112985,262144 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,15070880600901199802,6185075941635101959,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,9461121318128559586,14769589657674109718,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,54159239234694011,10195520186712189186,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5296,i,4657438828304871484,4489057700023860761,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,11138601728832884709,9398200652672792860,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,14165127492609286230,564780494427496286,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,7931840088282206340,13846476859988296687,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,7931840088282206340,13846476859988296687,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,10632131198326114780,2664310088969704946,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,12425227793211834564,16718974978423529460,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17022490558537855553,5067545635388440781,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,11212566312877894378,5933951436036512839,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6332,i,7458549200152862941,870753359094774156,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2756,i,10770516957306743880,16090671243362361334,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5416,i,15043723141856644327,458672748651981125,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,4042086973752614112,3139048372706758190,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7056,i,16640346575578996954,6988486079468433123,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5108,i,526258480664721934,5462002720137411586,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4961324339439799665,11581105646785794365,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,1329816413117566312,1944972691156031524,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7696,i,4489607592117347185,15942684970818282663,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7804,i,4761068127261934251,14672615197001245064,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7788,i,14400160295173052674,6279130468974598303,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6244,i,18228297025222189106,13329831074551908995,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7204,i,11094911210723598354,8670986064897779177,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8056,i,17639758626775779587,1816948887987653606,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8248,i,9104372968117296383,11101632476226491387,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8400,i,14578529813705658533,2713612525407380386,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7896,i,7779806483865064545,12309084864821908497,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8688,i,679916114328484512,14075532151944846834,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,15804795883268393862,14495002351883830915,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5984,i,9168420271692343007,6323993282108417293,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=2020,i,7319357160668466903,5314286365397744267,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8892,i,1415825353676748671,13354906557664032068,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9040,i,2503544349667313277,4404828369924372162,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9176,i,12359236832502268656,17854200957281859394,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9340,i,1492910737858797426,16307425455446331591,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8396,i,15216361992990941816,2979806168225914900,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8616,i,6915326986905238136,8622997855138572136,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8436,i,10524911891545387919,16185265746681451559,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9744,i,9793899869216208403,7054150284668577762,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9900,i,8092134369946979670,6630366949056942739,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10140,i,15677900847928243430,719653614529005394,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8492,i,7046394121795879350,14547390622431603539,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10356,i,1911817235221766198,16695955920103448678,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10352,i,11591281232561202866,8327567948953547123,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10404 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10580,i,14141136839657871355,6427560793823970526,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10716 /prefetch:1
  2⤵
  PID:6416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10740,i,2462366821868421070,16232209563776258254,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:1
  2⤵
  PID:6424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11056,i,10320134103483373996,18257387122408186384,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11048 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=11076,i,2612174756075974185,4006330599235855496,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11088 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=11224,i,9731766380190550633,596359384313542502,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11236 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=11488,i,3599705030330095640,8486390709414778289,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11520 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7132,i,3125076945024935263,10249817636266968937,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:6884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11268,i,1266850697108748637,16623318284508649640,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:6892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11344,i,9129477423785363997,15283822354444276774,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11348 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10772,i,430520708522096191,4971227610288439166,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11180 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=11476,i,9822854257933671511,6485076781035060653,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7928,i,2529418996747405560,12512605231520592037,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9920,i,913860208102375765,8164759762518815996,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8448,i,2801254566252437056,9495608638738241829,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10872 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11916,i,12226015558535995556,3358118837595330528,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11688 /prefetch:1
  2⤵
  PID:7140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11964,i,17943222580969831304,13383732303836629761,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12028 /prefetch:1
  2⤵
  PID:7148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10796,i,15807364254735547937,10656197478843006805,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10596 /prefetch:1
  2⤵
  PID:6540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=12256,i,11830154154548902254,7336094402192669485,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12344 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11188,i,16667420461449706762,16386124467488939589,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11000 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12624,i,11778688657807453225,14292718087648783561,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12648 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=12904,i,13433857526079908894,684038553463496678,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12836 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=12880,i,5473509438335164870,15062346805609484672,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12996 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=13120,i,17802896451728864849,13314483895197298190,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13168 /prefetch:1
  2⤵
  PID:7252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=13192,i,13053549207010188263,11067719438882890398,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13268 /prefetch:1
  2⤵
  PID:7260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=13408,i,11221003675590924391,2499944731255048342,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13412 /prefetch:1
  2⤵
  PID:7268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=13416,i,9151718539138723266,7698620194877553799,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13548 /prefetch:1
  2⤵
  PID:7276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=13596,i,9919395184516972096,3490883844100837497,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13752 /prefetch:1
  2⤵
  PID:7640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11916,i,17022653346838106040,17206735227105022946,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13920 /prefetch:1
  2⤵
  PID:7700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=13764,i,15060317100170899380,17560902875883905127,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=14048 /prefetch:1
  2⤵
  PID:7772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=14192,i,5983276359947202512,18322218190262688969,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=14216 /prefetch:1
  2⤵
  PID:7840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=12876,i,2395460573282296219,16492789841478442321,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13256 /prefetch:1
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9536,i,17933774290918060570,9858338189721039868,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:1
  2⤵
  PID:7472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=12188,i,8850234358343481255,8861289329779779946,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:1
  2⤵
  PID:7684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10684,i,11319172452707130695,14593039631175576463,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10052 /prefetch:1
  2⤵
  PID:7668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=12272,i,8192023974992461781,11175516861259723143,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13804 /prefetch:1
  2⤵
  PID:7512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=8736,i,9034897667329432514,17350807222165791814,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=11532,i,10094014236537076860,9098298830707885347,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:7836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=11580,i,17040229990437260458,9218110360866948032,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:6204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9936,i,5914533783035761940,11617636560588432433,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9996 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10004,i,6917053678192302602,1477194903416030053,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9952,i,1754407119140054235,11187376891043350845,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=14000 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=3656,i,6978795975954654010,15236671744560323918,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=9512,i,14244322425661138988,9534649922333766693,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9076 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10428,i,11592204754359175699,7624043448422811981,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:7468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=12380,i,10240226779020815003,14721630636372784182,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=9016,i,649803958053108543,16586001392634432337,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:1
  2⤵
  PID:8056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=12404,i,10431272181581266757,2021256121439313168,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12472 /prefetch:1
  2⤵
  PID:7320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=12292,i,10020948175258075328,16810585940288801584,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
  2⤵
  PID:7328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=9380,i,55281911463112480,9309150704497856074,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:7344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=12388,i,17156627001234464282,12150428026864500285,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12416 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=12272,i,12242791480622127214,15872663350892602857,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10004 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=8352,i,12405164953893914156,704216649220297519,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=8612,i,13561676275142496790,12649380228305542170,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=13744,i,9621588210208371851,6696638036931727321,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:7880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10228,i,4818049634095328999,4622533375748963324,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10520 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=9888,i,12501317437948751353,226960755856665718,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:1
  2⤵
  PID:7208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=13956,i,18417964031655617622,805827357379373550,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=5436,i,6597111614899063660,12338055483358196319,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=10064,i,9346151356772527839,2505582999986893037,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=12976 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=10048,i,6212912691508502798,5961833559404046879,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10540 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=10896,i,6025204234825313690,17401056179867200251,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10408 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=10952,i,2509818181594079509,1497701916980780525,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=12704,i,11145175769467818971,889825825525795682,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9616,i,8979366798761707310,18333615489949777283,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:8
  2⤵
  PID:7532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=9644,i,14665383772543073445,9869081252501122031,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=14308,i,10688818281190567868,7503354812222300452,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:7844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=560,i,11961898237974454258,16920759482230556102,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=10480 /prefetch:1
  2⤵
  PID:7960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=8712,i,159763744012001720,12447725732477868856,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11044 /prefetch:1
  2⤵
  PID:7956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=12072,i,8828722743246870214,15647131106031550489,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=13748 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=9532,i,2627507196920626574,7995508577018277629,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=9012,i,6999566100782936104,11558862203618549235,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9488 /prefetch:1
  2⤵
  PID:2164
- C:\Users\Admin\Downloads\winrar-x64-713.exe
  "C:\Users\Admin\Downloads\winrar-x64-713.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:6220
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:8128
- C:\Users\Admin\Downloads\winrar-x64-713.exe
  "C:\Users\Admin\Downloads\winrar-x64-713.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7072,i,11781013214707643232,5688398409603897442,262144 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=12356,i,7835632762247071176,10876146109560785831,2097152 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=11676 /prefetch:1
  2⤵
  PID:8000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,7429011792763776256,404232609618037083,524288 --field-trial-handle=2592,i,252501743537473795,2664889516930768566,262144 --variations-seed-version --mojo-platform-channel-handle=9432 /prefetch:8
  2⤵
  PID:6432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6580

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Desktop\BrModFinal.rar" C:\Users\Admin\Desktop\
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:980

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5504

C:\Users\Admin\Desktop\DoubleRunTimehost.exe
"C:\Users\Admin\Desktop\DoubleRunTimehost.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7628
- C:\Windows\SYSTEM32\ping.exe
  "ping.exe" -t 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6444
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 add address name="Loopback Pseudo-Interface 1" address=104.21.94.101/32
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:7448
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 add address name="Loopback Pseudo-Interface 1" address=172.67.222.88/32
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 add address interface="Loopback Pseudo-Interface 1" address=2606:4700:3030::6815:5e65/128
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6300
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 add address interface="Loopback Pseudo-Interface 1" address=2606:4700:3032::ac43:de58/128
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2212
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 add address name="Loopback Pseudo-Interface 1" address=103.153.64.28/32
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3796
- C:\Users\Admin\Desktop\DoubleRunTimehost.exe
  "C:\Users\Admin\Desktop\DoubleRunTimehost.exe" --watch 7628 104.21.94.101 172.67.222.88 2606:4700:3030::6815:5e65 2606:4700:3032::ac43:de58 103.153.64.28
  2⤵
  PID:6248

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HƯỚNG DẪN SỬ DỤNG.txt
1⤵
PID:6764

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2960

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5512

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4980

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:7800

C:\Users\Admin\Desktop\DoubleRunTimehost.exe
"C:\Users\Admin\Desktop\DoubleRunTimehost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3460
- C:\Windows\SYSTEM32\ping.exe
  "ping.exe" -t 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3144
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=104.21.94.101
  2⤵
  PID:7100
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 delete address interface="Loopback Pseudo-Interface 1" address=2606:4700:3030::6815:5e65
  2⤵
  PID:7908
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=103.153.64.28
  2⤵
  PID:3480

C:\Users\Admin\Desktop\DoubleRunTimehost.exe
"C:\Users\Admin\Desktop\DoubleRunTimehost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3908
- C:\Windows\SYSTEM32\ping.exe
  "ping.exe" -t 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6268
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=172.67.222.88
  2⤵
  PID:7564
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 delete address interface="Loopback Pseudo-Interface 1" address=2606:4700:3032::ac43:de58
  2⤵
  PID:8080
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=103.153.64.28
  2⤵
  PID:2268

C:\Users\Admin\Desktop\DoubleRunTimehost.exe
"C:\Users\Admin\Desktop\DoubleRunTimehost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5032
- C:\Windows\SYSTEM32\ping.exe
  "ping.exe" -t 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7424
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=172.67.222.88
  2⤵
  PID:3772
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 delete address interface="Loopback Pseudo-Interface 1" address=2606:4700:3032::ac43:de58
  2⤵
  PID:5460

C:\Users\Admin\Desktop\DoubleRunTimehost.exe
"C:\Users\Admin\Desktop\DoubleRunTimehost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116
- C:\Windows\SYSTEM32\ping.exe
  "ping.exe" -t 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=172.67.222.88
  2⤵
  PID:5988
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 delete address interface="Loopback Pseudo-Interface 1" address=2606:4700:3032::ac43:de58
  2⤵
  PID:6596

C:\Users\Admin\Desktop\DoubleRunTimehost.exe
"C:\Users\Admin\Desktop\DoubleRunTimehost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7092
- C:\Windows\SYSTEM32\ping.exe
  "ping.exe" -t 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4764
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=172.67.222.88
  2⤵
  PID:8164
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv4 delete address name="Loopback Pseudo-Interface 1" address=103.153.64.28
  2⤵
  PID:6580

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
PID:3848

C:\Users\Admin\Desktop\BrMod2.0.1.exe
"C:\Users\Admin\Desktop\BrMod2.0.1.exe"
1⤵
PID:6332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 39baa167de334fef185ae8b97e8c709a307eed08e80fe115577c59a05200a13a
MD5 7c7fadfc3884853fe0141609fdb1e624
SHA1 36261b2b3cdbce62b6a9d3139a6c239467a3006a
SHA512 1d868f5665f6ca182d07bd21ee0e2158cd00062e2633c4845eaf31a242d5868f79f833fd37f87b54f17adc63c7804b95c9d3bcf66c137484f2615992b69ec0d8
SSDEEP 12288:Kxytky4LvurgzH9C/2qCQW7oIIvS5ejcwU:Kqky4Lvurgz62t5cYwU
TLSH
T1CD949D19E7A455F9E5B7D23CC9924507E6723C51CB71D38F03A10A9A2E237D09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e7fc7e1e7de70e805f9c3b45886f757b6f3e32affe276a2ec24f361b5072f8e6
MD5 80ca8e7e9050f69e448f360b50c79cf2
SHA1 ab814e37d389dbb51bf8c29d3d6b13b620a426c8
SHA512 dc1136bae8214070aa0565ed926404cd9dd973da641229124edb3108869458e28ab423dd0b22d1f57b44de8b931ae845dfdcc87cdcec8b7bbd731bda1ffbe379
TLSH
T13FE026A68ECCC32FEB08B487416C9F4C8A903B0F93CC7E0E172C898474411C8B2A26E1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9e66a5b376a36087276af7d1036138f44d27cea39a6790c72b5aea25034431f9
MD5 074df4e43977f1a817cddedb4da8d879
SHA1 c22e38b4423546769bdc57aa2c52b5b75c62ddf1
SHA512 5eddc6cf69e0fbedc6bd081d0e01ff1e00921999630661ecf0c3f29690c89f77f83a71168f8422da737289de58d20301393ef943cc6ebcd0310c45619f28b64b
TLSH
T186F02DB5CC25BC3B18FC1B1910A45A46F75513572781898F3B3D810D8FB1A378546C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 70KB
SHA256 9e1826cb1fbbbc5112fdf133ebfbd13884530c05d90af402d9360eb4968e2cf7
MD5 a8bfc2117dc2bb93a10bdcfaaa7e96ac
SHA1 b429907ed6b1a51b2b8fdb54d7fabc8b97ec1d16
SHA512 74767b4f2133ab3d7641669f667e8c035e5e4617c2cf2a0e61c1fc4d21aa3acd6f47bee8e23a1bbb6a3a27cc024046ad42c0e86830e4ff73a1f68dae2383c74d
SSDEEP 1536:4c/a+uOhY49frHz3ylizadM0GS+HJcdoTOxO37+feBeysLnkSDsJhhjQHZLQZY://tBhD7yli+60GS+Hm+CxO37+woLnHsu
TLSH
T1516302E3508E7BDA022B78851C1937FEF0811306C6D3CB476EDA5B1E689B27BE751109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 417KB
SHA256 2a13f157806bd2083eaed91e534af6a89490233e69dabcad37664cc1121764e4
MD5 c1c170a1ce64b59884e60f2344a22a4e
SHA1 61c14d8f5fddf53dcab660c90e3e754ad074b48a
SHA512 2fa7dd1512c1e3265cfb8890d130e2b8bf53296e467bb54bd018e4491f8ef3b39c83c1d9a16584188fb6c868b97c38352b48af8d4402bcdf7acace6e05879a82
SSDEEP 12288:FX2/fOpN9bjHHD9Y4B0NrAfC8miUUwee9WOlCvRrbTXumvXi:Fm/fwbbHJmxAfxPUU9CWCCJX7zvS
TLSH
T15E9423A3F302EECA998A7CCEBBC75C854E14347C68CCE697416B584147B87990696C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 32KB
SHA256 b25ac478867ae81bc30c171516c59d76e75a723f90f0e24e14af6ac2000bc29f
MD5 24cf6f618199f26b51a3d9e452e57470
SHA1 77ef4656c300eb9c4ab657152691779ac7622577
SHA512 224443c2a828c38b367fce3d5930aee41c3ca9682db7ac409d61c405f63a4aa3a8e86335b33b12b2bf37ecc4637c0d73a13f0af2faf270bd70ec235b3efd5846
SSDEEP 768:sxS87W4QxjoDd6dGefB8+8dWWVhbSc8IkxT07xvSlpPnQv9W:sxt/QxcUf7jWL9OYvo
TLSH
T1A5E2F103D97600A2E9A33A17565699E0D6FB1BE911B354CF2C30D6D583224B1DFE8ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 39KB
SHA256 b05847904e965e8a62eb81e89bee907f7cf9754c343cfd863c0716ad9f5fc829
MD5 be642fc9e07c61790bfbbd333f7e97bd
SHA1 16b7cbb3d43fab0afad552ce5270f4ac23ede523
SHA512 9c076f1e820aa294e2b3d4bbbd7bbc996c171f3f0e87b2d4788da07c4cd124d8f04e75af8109c4c94457d201cc8eab552933ad69aa8b6ac9a54393cde727944e
SSDEEP 768:/7kLPI047b0xElqhWS0JTfLbb/d+SmV2r8zePiI9RJg:swZ7okFdbXwY7iIq
TLSH
T1D403024D3585035D3621431427DBD15E39B8F4B36EA0E5196E7819FA0839FBA821D7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 16KB
SHA256 454d6e6f37852a28fd5c57a91e8975d8b667b3f7ab98d81f12c4c9ee9035a927
MD5 19bbf27e0e75c63a7f20e2768b86c398
SHA1 e429c8e100ca9bce18bae304f94f793c8355d45b
SHA512 1f011509e277f283e0e7527b4a35dd59051aab844ea03b3e3479172f974ff1250be6087d06f64112b921a6bdd916f10ec7b618b3cb2e5252a953e078ff8cb97f
SSDEEP 384:89biA5d9HtBkn8V7tFqm1/Khi0nkdJw8HolmfiQT5maNE:8/f9jknY1a5nkc8Hem6E5BK
TLSH
T1EA72D1A24DC9013666E5A4B9874E7C1E7FD98B340C4675CC22E3B4EFABC263B365500E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 114KB
SHA256 d3298ba800c80577c206b33ce9d90b07eb79a68bc98b1c7be473e19be69e54fd
MD5 23c70ed27ba1388f3374b6d7f2e2bf9d
SHA1 ac3e74029bdd04bd6ac3bd3a086976ce1cf73552
SHA512 933df11a077ee890b7ccbed9293023ef0b4984e878fe9ef76fea646f77d08bea1294edb4d44fc0c6f3cd62344cf0085f17b2dcdd2fce6274e4794a273cd0e0d9
SSDEEP 3072:mbbF1beWR+2ogFxYJ2mS4xBs4vSx7jzTbCIOM1:sFVeWlogjYJ2x4nsE67jjEK
TLSH
T135B3122C25BF4F1D2E11D374856E7E8C8B00A34974BBA7C7297FDC2206196122A5F66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 36KB
SHA256 0f13a2c5a0d75513f606e698f66ab6ccf3cdcf47fa2d02b69b8abe9c1ffc99ad
MD5 1fa1f3508233a1589e6e1794bad15248
SHA1 f6c95f880a1abda840f31dc120e08b71f0124fbb
SHA512 c11271b955267465e9de5bf6e6a352fc7fd54e13b1a3f6ca014538048a245ec7450d1e81f38adee1f3801731b802c51286a344a8f8d0e50fb7fdef45c82e9711
SSDEEP 768:TgxIUozK+E/qS1QTkEAunJyXiLJB9n0Zh6ZZZDMj:c+znZScEXiLr90ZhyZmj
TLSH
T12403F12C297F667246CC91BAAE4C3587700471A3A67589B41257C306EE8E82A36EBD47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 57KB
SHA256 79a355d666327a3ebfeeb2f7861dbec37f08e66d3572a7ee3e14ac7a14023535
MD5 d27744e0c0a9614ed3c5a606f7f699f2
SHA1 22648dd14a68847161015e9e5be7bb314611617a
SHA512 ea5aa7e44ef7fdd41b9bce095ba719c67b875e9ac94216abb8d994907e2dde17811cbfcb09fc7e3f75701f4bcd3a06f8f4ed31381bc3d7055e8f21b1aa9ff2f7
SSDEEP 1536:4j7Qz7zcfvgaQEhU0K57u5o/Q0nmJ1piLc6Y2g:G0nsfdJKFpY0u
TLSH
T15B43F1908DEAD6E6F3A325B1E91C6C42CC70E4573A66DC2BB90CDAD4583F05DD407267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 44KB
SHA256 ee4b95d652487ebd6407b11190799eec5f812a80d1b4c78ebd702e3af839c830
MD5 f2a7e56bd268f2731f60df949a4c0fb5
SHA1 ea8ab4c0e958a34d53477f499d753a1b96c86ac9
SHA512 e64bc340cf2dc7fbe0855834ec5c6ac93b08d170d3b9f9c6ba2035cc9d6f27647a735265a4f6e176893dd2fcdd8ee0f30f7ba3a73e0dadef6614fc4e6d9c93cc
SSDEEP 768:IG7HnjtrHRUYg55bYYNhjwcN8wj/qPqE01PEQvxX1EgBUQNeiCFI9PpgkPlB:IG7HhRU1N6cN8e/G016OgiI0fPL
TLSH
T11E13F13292FD7052D9C3E8E9AF5954F23BF00F6D0428B6726B7B009A471A7892E97416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 147KB
SHA256 daa377d3c0ee48d595113bf118aabedc1de93c6b6ad417e9a572bc55a094c1af
MD5 89640e2af058c400ae6e12a17f18f6ef
SHA1 c4026ee7d3bc8425d1c761bfca3b7c210ab0eff4
SHA512 b9a0bd3b5c9ea0f4092281cc942612dd8c13f3f7b1bdd44d97755e9aa240eca739c0ebddf4633e70187821a5a27883c75825e3231bba8469f110c2b02a7371e5
SSDEEP 3072:noNRYHFlcp9hLV8qhmcS4Vjzk765nfV6Lw6zyNe7hSDt/V7hcWm3ujVj:noNRYllcpnmZ4Vs7gd6LlyNUW/VlcWpR
TLSH
T12FE3120136618C462E00DC809B8E2A8584EDACF9350E6A6DB54DF7F7E354642DEE929D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 188KB
SHA256 4faa13d74459102c5fbe3be137b2904a47a57b9a17f942ce56404a82fa01daf8
MD5 5dbb0b7b05c3a65ccc6b4cd7e23abe1b
SHA1 95e73365a6252415de5c49f87343f87c946f9a46
SHA512 a0e6ef351ddbd3badf674d370164d34c0b22cdbd328b2fd22123c6870fcf3483fe7354ca248aca2033998c55e957273ad90b784b20831de37edecdfd48c1c438
SSDEEP 3072:gIRVk2TfIVXq85bpMDlwl4a1LDyPVrrbVTPRHOFwflbGupK3sDxbxpO5pMKqTosY:Byq8Bp0lwldVGNHbVTpHO0bGAQsDx7Or
TLSH
T1D91412A4EB329D57FFF9E09C98456F265DE7087F040389B12996F43211FBA10CE52E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 22KB
SHA256 a926528575f55ef72cea9566255d2b09812d7d7766d1d228434f283579cb8269
MD5 e878eb275373bb62c4c422f4b1befe4e
SHA1 a0caa1359c167e3190816188fdb08717c177275c
SHA512 db7f202321b45f645ed82e8fc91fc4a953f890abec06768821d8badea99bcbc537c71c74fa6d9c63ed10c09576fc50ce26faef80c6fc12b45577ef2c3699db3e
SSDEEP 384:BDYw1r/emlsbzNoWppm3kFvTsZONMN2v3FncE6V3v0GRttk692y/gLq+LVL7zF++:BDTJmmlYjEkFvwstdf6dv0GPtkkpKLVX
TLSH
T162A2E0D67F730AAA12C3DB33028E19579950E860CCF6E95A3A074F6AC848572FDF02D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 31KB
SHA256 f1534ae841df05b20eafd654136164198eb08c1eb811a59fb817925d207601ee
MD5 bfe7446efea6fbf3dced2515aeec8793
SHA1 d812e07513c4a13bd2a442d21224a81a21f401e3
SHA512 d9eb55aa72775a8b3390cb3950c1f318e88e2e854c956c1b305a9aeeecb05a679584fcced7057ba0bf10e91c699300703b9408af69eff62aa732d64db7d51f1f
SSDEEP 768:Sp2lqhZUXCM/Bpebqk5Ss3i+BP5UY37SGVlGXYCmWwXZX8mwWC0fadf:Sp3h4dZpexBBl37JEXFOBCdf
TLSH
T17CE2E12A176891087A5C0DFA906ED52EB154FBD4D0E7B48184CCB53BF32461966EE683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d8
Size 21KB
SHA256 bed514a326972fc0947503666e200e60295a7aaa789818138ecd4b41c3f359f4
MD5 5b3463c6a60e81bb4d17c13c1505db8f
SHA1 317df981ef3a0c242e40fa964368c0d3b75d8623
SHA512 3979438111bcc157cdf40c9091dd24503f5262a1cb494b904ee07a1b8b0124733a402dc800e5687ed7605f131a59009ca1ab85f56f17eff152e98bb47257a274
SSDEEP 384:2S7YCn02R1hBPf/Ezj3hnGuiXIc8lkE8127B2qViOIiw2aBhr46BgD:17YC02R1H/i1GuiY4D1bqViOIZRBhrns
TLSH
T14CA2E18345D8077B4D214902E119B8AB9F27F1F7CF76E90BD04BA96C44E463EFC41562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d9
Size 47KB
SHA256 c940764593d0fe5d596be327ca7558855e018039fb78509aa21921fd3644c3e4
MD5 65850a373e258f1c897a2b3d75eb74de
SHA1 1dc044f4824fd5af6bfed67fee48be70fa069f3f
SHA512 df2683f3dd9724de589451a47bc608c9925d54b874ad97b733dd465ef41f9db75e9e31604762415c2fc1433d050e45fdefc6ecd7ecadf58d1243d9ca5f4bf74b
SSDEEP 768:3IkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBA:tNYoX53xTl/R8W77YNtUFrWoUWvdA
TLSH
T156230251F5F8624A7FC3003FBC317BD862909FE5996EE5D91288F30225611DD29EE017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000da

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000da
Size 34KB
SHA256 6438d7b8ea9c7c3992d5e2fd2afdb1ff948570a3ef0bedae76247b51632960ba
MD5 c154477b9affa3a0a47f894c8b80c03c
SHA1 b6711decba0d571b538ca01de8a6e70ae4d219af
SHA512 4573c7b0c16c726dcccb6319d6e7fb0d163fb90e1fcfd4228f7c471d52dc4076a5a59b6516c5ab613eadd6cd269b327b3f2cb4f14c2b336c28d31b3809283df0
SSDEEP 768:/plpZnTpd3+CSeY9oJ/P17/4T1HHAG9i6XG2g4voyj2i2619EHGh:Rl/Z9d7/8v/mGCL6fEHGh
TLSH
T1B8F2F2C17E122F303604F5F6C0B653F67372E495EA5B8BC098A65576CB06F15DCD904A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000db
Size 34KB
SHA256 63fc42fc6d824545e96ab3dab77cafa86a5f1c7895412c0be5d41d519b742c7b
MD5 c720424affaefc9fd5e66987e15c64b3
SHA1 53e2e750eb54d7c78b360acd228cf60ecaccb3d7
SHA512 fd11648b66ef5ab5eb6120740e75c9cb8d7197f1962c28d7931690be25d120e1ac8855662ca78d295214a3c7cd0b580ffc40dc953aeeba98e6d35b76f81f3be9
SSDEEP 768:sLQ1ndMcMY0LNVblfxL34yzw0kYHth+2vhvuSZqRU5ecdR35gpX:scHMl7lfxb4yRthFttxdRQ
TLSH
T142F2E1CEAE9A3F4D4A1D9CAB8635BA676871D702CD9EF2B28D4B0E5DC4204105DBB1C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dc
Size 71KB
SHA256 a3fd11b23ed076af73c64a34831645a36eff521a3be0ded8e872c13ebf2f223c
MD5 d67f83a57b20228f02c40d1a9db53665
SHA1 e3c11f8884931c40592583cf8a5b8e5db9169bfb
SHA512 e746fe4985f2404690fa5c19a1b0190bd57277ffaca09a562d1308360c326752ecfef8f06843f16347e4ab09c9e7ffc99b00868599e08cbda11e7dd8507cde8c
SSDEEP 1536:GanR8ub7lEIaL5jQGsWVrVZF0wUJIv7Ia4SvmLH7:Ga/EPLqGlrywlIa4Svgb
TLSH
T1636312593D18668DF400D69604BD8BC10B519DE4251D1B920FF325AA9F3A38F33D4AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dd
Size 98KB
SHA256 0bb58d9ad8e89fe85fdfa05a4bb795b5ed6f572872e7dfdbb02e8f00b4956c32
MD5 2ba0a23797715582d07eab178f1bcaf4
SHA1 86a2648e21e382b226f338fb412d4f91b0a41c32
SHA512 a0d93e05b1c7853d51818d65f64e0004ee085d832558d7684ba08963efe84faa4556ca179cf2b5e6120ba2ab11755002cb432bb6ac563cff64542b6c78d5c4df
SSDEEP 3072:ZJDmqZH5A2Dt8wC0OA6OkFbmBsz2y1Zb1d0B87o2nbN:rDmiH+c1chFbuszr1ZbdbN
TLSH
T102A312F4D48E9EB90C5ED25F1D349EE408FD16990272E5FA5739B3C2A0681B34A97C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e3
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 73KB
SHA256 49a03740a4e90cc48b80dfd321acedcb4f185737b0db715b9c457e166ec228c1
MD5 e22ea5d77c21dbe09b4aecfd78c99334
SHA1 75971b5376be038ee88b73915b0b95fd329643d3
SHA512 0ed60669feed190769b287ac60aeb0269de18a1010cc794473d9e5077e8cac29360ba45d2fc6fa4046243007632880752afd9de90632be551e9bd20ec258489f
SSDEEP 1536:BLgIdWkCEDXIwf1f1sPYNvx8l2bNrvB1xmDfmxVlXrJMl4:BRWkC+XI61sPevhtB6DfYfXrCe
TLSH
T11C7302B1CF3A4FE4F54A70B1EBAB01BC8169494D90A486A941057C1D3CC7ECACF2BA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f7
Size 25KB
SHA256 a2ed66f01753747ce359a8be0a9555b91e18d01c6bccf8e52a74078520d3720a
MD5 7077ccb28e70d467500f6994c16ea6b2
SHA1 b47c8f61db3e92fa3fd0ec2e5021b4ca3586a494
SHA512 aa84c24767a1aeaea11b48e2b8b4d10a9f668839030fe47d132a425dc5cc30954c7d6106ed1d6d1522d42266ff03c0b7be0f1b95861fba79b6073fc9b992ab62
SSDEEP 768:3lBWG2FODWjwQU5xhjsNxSyk879qB8RET4qR19ZB:vMFOKUhSxS1L86pPZB
TLSH
T1FCB2E1CAE9CAB097AF1FB05F48E22D256E77B20EF00AC57647A14DD4657E08345E232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e07d40f492ee39923a7d70120bb5f2bcb94e7bf1fe0b2470fc6c04008dbc28f
MD5 f6c7ccd3fc6e45bfbfc45edb593f004a
SHA1 94eb0e02e328897ec0f58571559af43a4668cf46
SHA512 6d9972fed329bb5312b486dda39f2bb2ba8d15f5451ee02c67db7e4f7a3a0f39f5730afa64f635e03496c0af2ef737773e2dc50d64b739bb4727d731f24bdbe3
TLSH
T1CF71A8D0B89474F7FB4A19F191E5A8433E34768458832E7231A4E5FDAD86BD8E31007C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 4cfff0854c6e6bef8c0ca8f473b65c4446703c318d6be27c278e00b909ae7746
MD5 1ff185ecdf94c07223ef1db54e7da6d2
SHA1 bab41ae7300aecf40d5de9c0be34eecba6cf723e
SHA512 9309d4703a919db2b2238efc001b71f3bf6d3e9ee0fa98fc7248ebd21dadf4690e7a39259ae58027dad430d4cd0df21393d698f5d6dc3696c2bd4ffe27f68778
SSDEEP 192:sVexE7jN37NMtRknHDQSsctVFMKhPyn7pev5Ow0VFEp0pEuglFBEWl:vg7SS6SdPSpeROwI6E4EWl
TLSH
T15A22B6D472C0E392FF5509B060B1EC4A3934754AA4E71F521920E2BDFC3BBC966D0E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 f6bcdf768c95ce2161de4b14e6963e5da0e50b3058191dd0049f23a6195f7908
MD5 1829e8d10e9fae9a8cfba3fda1eb8844
SHA1 2177ed25fea9e89ddb27e73f86356f3990d216e1
SHA512 4c4290d06d6188e5dbe9f77ade63574c1d0f45cd7b43aaef7766fa795d69aac57c0f677540466c91a39dcec8cf4e85db78b85196f4815fd3b9e75db5d950df43
SSDEEP 192:2RtuAQN3mEUcFnDbnNkTEnmehPycBX+JQio5VFGbI0A3rgXOsgVL:2smC97pPpXNiozGAQQL
TLSH
T12702ECD1B7D061A3FF5508B101F2EC4A3838358AA4C71F562860E1BCFD7BBC996106BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5910bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5910bf.TMP
Size 3KB
SHA256 67d5362a6852c36752c7e356bc9455ecedee91259f17cc54f2793dcac8a52f83
MD5 446ad67d204fa2ef2664eed8ea49ac20
SHA1 b2b9b450df49fde0bbd30179b53c14a265b6ee25
SHA512 6e1caf22c6f7455fc58598324e69153107137d93a2e2a13e0cfbafc0d4d716bda01a3134b08faa434c599815134809889e8934948e79e7402930b5c62df20457
TLSH
T14A6183D4BC8474F7F79A56F292E528873E34768458872E7230A4E6FE4D8A7D8A35007C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 94a34ae7d78fa89574956bc3fffb9a5501e0cb183eba3feffcc0e38e562d0a8a
MD5 41edbf202461b31946ce090be6fc929b
SHA1 4c56e05af212fcad91c00fd6813fc43c003f3c5b
SHA512 d143f193fe3ccf2ad672233d67186f5ebd8a813e2d14e77a21ad7a62ac911e9579511bf4b3fbbc7910daddfd6d96fd6aef1328c7baa7cc070176959a41a27ac1
SSDEEP 192:D1rcs/roBldSLSvT9Rrroq4wa214yfrnY7DUiAVQT4V/W14pVHoAIoxi75TqtzjX:D1rcs/ETdSLSvT9Rrroq4wa214yfrnY0
TLSH
T1AE32ADF3C3E5862EC91156F49A14AE1BCF1C0659432C3D2988D4EE4BE3F2472E155A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 53KB
SHA256 52ed04d38b2df94447cd76912a923780f1cfeba7053cb2613c8a1fc1a754be57
MD5 6e2a0f1f791a5f1f311db6eaa807e369
SHA1 ddc7cc4f84cbc7991ea630cde611bf0c30a3ac3b
SHA512 0d88118e292ef25f44bb41053e59eda87bb1a1c9c0ef0b2ff38b6a43a8427fb9238de4bf6676e76174eb13742d08c438b18c68e31e9155992ff0e6f390338e0d
SSDEEP 768:3Onz8+e3mHBXoJpdRvlEliVQTh/pWKFXHyX:3OU2HB4JE3M
TLSH
T10B437CF3C3F4666DCD2266F46A663E1FCE6D09149728386F89D8AF1653E1031E201B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0a862892170a0281344eed008ce05cff307790326e7a1c951eabf602e0189225
MD5 010fa8b4d7f8b0ff8d62f3df36315c56
SHA1 c21e72dc19921ce991bfa57eb61407a8a9f0b90d
SHA512 1b36f19b3ca1f464c1d4fbfb3cade3f47abd35f8087e925daf589f24a799bd0aa973eadd05bc8ebd9076b91cd31c672593a2041a74f749665f202fc5eaa32502
TLSH
T165D02323170930B9AD7C5EE54055ACCFC36610547543DED410E1BC5C093545D0657584
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dbe1af66edeaa26be0edd976170cf0b0f1078eb34c96acc5c2f44e03dde3dfd6
MD5 a5944c21c8549c12cfa2510cac0b51b0
SHA1 a1130104e0c2d8d1b81e0ff19942b7909e3c8234
SHA512 76681b7b01074f5ed64962806ca79afb25af06411c8d7c8a14811c58067d5b85b8dcdb0a5bca1bd2b5333e7656c9f08769752863d0114ff08c9c399c252483a9
SSDEEP 192:sxZFRRWPE/fBXseYQZZQHmodp4AAHW6+WNBLZ9H8XYbIiZYzgIg5w0J:sxZFOPE/fRseYOZQ/UHb7KXFaYIe4
TLSH
T1CB42E811AD78A97BDCC7D209BA55BF53E3F95032A0951E48A6FCCA1C14E7ACD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f3944d37020a281f67eaecbbbd8873cae9ccc3c6f686d4252828e7736723842c
MD5 7e90784ea2c4a8e051ea5d2c3134909a
SHA1 e23e5b082a2d6cbc10398a56913e491694d2105c
SHA512 6c5e39f5e9333e79fbebfd773babca7a68a311d669f8930511aab0ffa3ebc26316846317e8ee8f98d85c5f267577626eca0549edb9da531fc6a606a5a771cec6
SSDEEP 192:sxZFRRkE/fBXs2cQZZQHzodpuAHW6+WNmlt/YbITZYzgIgj0J:sxZFsE/fRs2cOZQMvHbW/FlYIj4
TLSH
T16242E915AD68A97B9CC7D20DFB55BF53E3F9503290951E48A6FC8A1C14E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 75389d5093c337c443e384c917144b3b98d23b0b502e36de43cb93ec71ab7b66
MD5 4592342c2155a7c06dfa9bdd459b7a16
SHA1 7638767904242a1a7585d6db5e789576d42aa4cb
SHA512 21d7699190407d3f11a5b00741be91ea2e4213b14939a4df2588f893f52d4c080bcbe2d1e39d2ea10e451591b708f7df06d13852e535be07cd2ec59728582b2d
SSDEEP 192:sxZFRRkE/fBXsecQZZQHzodpuAHW6+WNmlt/YbITZYzgIg5w0J:sxZFsE/fRsecOZQMvHbW/FlYIe4
TLSH
T14842E915AE68A97B9CC7D209FB55BF53E3F9503290911E48A6FC8A1C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 54e55a6db263cc66e334e4922f5e61beebf54320b59a7a9c39d90047a53d329d
MD5 7e7f6c313aea128399f22d7473e07401
SHA1 784f27970cc21cd7800eec7dc6abb688a7ed2a94
SHA512 32cc531b7ece69aa5c722531cb9bdf87ec5d971b8f5c102e67e79526cde9f7e43d2235bdac1e48051b5080d72cef983936a574ec3a754c603dc3d79efd410c35
SSDEEP 384:sxZvMmWE/fRseYOZl3r0IHbEZKXFgYIeB0sHs0ss:snMmWE/fMw3rHbxFgeXs8
TLSH
T1B982C7526914D87B9CC7C618AE35BF12E7F914239C964E4CAAFCC91C04EE6FD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1f37709be6577324b86b6df720e24f764f6f3f880ed24d1e348a1977d2ae329a
MD5 770fd0378d14797e1d63e18ea173224e
SHA1 6517fe5bb840ff302ca461f104a84d9063648347
SHA512 79febfffc1e21b11ba3059ad384f24787ab31ef0129ad54b21f1a5772ade64a08bb8ed364011adab270f147190a8bc9b2d406f874ac117d620a9bae920c50833
SSDEEP 384:sxZv6mWE/fRseYOZs3r0uHbSayJbSXFUYIeB0sHs0ss:sn6mWE/fMt33HbmJgFUeXs8
TLSH
T18E92D8526920D87B9CC7C519AE35BF11E7F914239C964E4CAAFCC91C04EA6FD2206C9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 f08464803d9ae82022b0de9ac6f86a4a006da99c8ced6268fc3b90d61162db28
MD5 ade09b8701c11fa2f631e95ee0a7d26e
SHA1 b71d94389e6e07dca52cfd0c770f9e02ac194768
SHA512 8534391cca67417cfb11756c47aa1534e47283959681d4e6e2cc1c2337f4cc85f7df051a67b1e1c2e9fb1a87a7fd0e0a9249bc0df28ded763d09562831210e69
SSDEEP 384:sxZvMmWE/fRseYOZs3r0uHbSayJbSXF9YIeB0sHs0ss:snMmWE/fMt33HbmJgF9eXs8
TLSH
T10492D8526924D87BDCC7C518AE35BF12E7F914239C964E4CAAFCC91C04EA6FD2206C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ecc08f5-88eb-4caa-b351-d1902bbf8467\index-dir\the-real-index
Size 3KB
SHA256 18bccdd98a06059f7bfe5976206fc606a17964985421139ab7de54a2d42a6cba
MD5 7c1aacd52f2d7dc56f5a8806da5b5b22
SHA1 8359f06b3720cc51db86236c82f1600e38763c0b
SHA512 3176565a39adea082d79b2d19f9a2c1e1146de313089074d81626b062f942c072b14d8d388c06aa6abdaa137f67eac5f9f5fcc16cc46791a025882ae459a8e9e
TLSH
T1C771C80F4E536F6BDDACA2B104B90449373466CC27842F27A5FDD135BC8B7285C59B58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ecc08f5-88eb-4caa-b351-d1902bbf8467\index-dir\the-real-index
Size 3KB
SHA256 8152154261055e91378a932603ecd4273427daab9af221a5af136e5a5fa2dc8d
MD5 117cb6f51d7b228a6d4bfba5c14e8f6b
SHA1 177670d493c95b8a8fd1d85975e52c7ac5ce1565
SHA512 402cd64a8c1e53fab8e475f3bbc2e2523f45a0ce050b26d7676dd20eaaa21ea0692197dfea8e55e81bc059d5efdc9a233bd89ee186eeebdedf882fe0f363c0d7
TLSH
T1BB51B50F0E522F6BDDACA5B204B50449377476DC6B841E3798FDD138BC877281C69B55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599c65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ecc08f5-88eb-4caa-b351-d1902bbf8467\index-dir\the-real-index~RFe599c65.TMP
Size 3KB
SHA256 731ee8d4d63a756f6c44db96e4007ac35daf8fcdd2d7ea443fca84c0aab483f3
MD5 a8bfbf873e39cbedba89f3e0e9bea054
SHA1 1a379b3cbf075ff09db33d4b1f9b1ed5dbefcee3
SHA512 b101af848e01c829bfd3a0112c1f57c006f9b545880fa0695fe0aa2f3ad15f4835a9823c9175e5b3092284d9433f5af577d75c4fedc907a7a1b118f97edf95e5
TLSH
T12C51935A5C030735E894427309EA58A23739A64887483F0F32ECD132ECC275C7C4A7E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45b1ba91-7fac-47ae-b34d-4b0764f1c879\index-dir\the-real-index
Size 72B
SHA256 bdb820552ba518e0644e039d43a5d6aae54027b16b1076112fa26e8e4ebba473
MD5 43fc08a993d87b818592b8c63e49425e
SHA1 7c61f53459754c8405109c55a9c90a2bb3a69ddd
SHA512 b3301a9a85f876188e40b289a56b6583c66310a6efcec95d340e97db7c375a2d73c592f78a5e693f600da7faaae1ff261b4e0ced4ddbd40399f2f1a5969461e7
TLSH
T118A0021816C00031D01623BB77E615C53320C9164202135751DC4298ED58D4A4D4130E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598f65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45b1ba91-7fac-47ae-b34d-4b0764f1c879\index-dir\the-real-index~RFe598f65.TMP
Size 72B
SHA256 2d0ea5c6ed3e9096e772f02c6e30571301fa462e17b180936323c1f075569646
MD5 e2a8a4cdcf577795d8069050e413fe83
SHA1 61807e00baea872adeae94cf0c72e03603f057e9
SHA512 d4edb336049e110c41843cda9feb9e70d89989d14e117d8c0e612a8936cfc4e994eb77aab587d5e35ec9bd837988bb193c5e3d2104911fbbfddd65c4f4aba495
TLSH
T1BDA002920780000DD52A95B11E5342669707F8161202230740A25049CD908505FA108D
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\73265fde-255a-480c-85bd-668af3469b9a\4f2277ea2139c475_0
Size 82KB
SHA256 edcaccede50bce64c1a89de0e1756427f0ff0d339ac552f4c5528c2775ca370d
MD5 9d5dce2e29b4ef8aa0b93dc59a8f12e9
SHA1 b370fb1bf222c789bb8bc929c72ed534070df76f
SHA512 3fec5c4f6699d1db71eed9040a396723179dea294eb34703c3c232bc7d246d6fb33aaa05d3a8cdbc8eb75a4d3326c35696b58eead1f2dc98a150203523d4fe07
SSDEEP 1536:ctONs4++HqsJs0wihp2VMGznXoHVyOAcU9dP2CsXPoTrhG4aEcyUqHPwqYzGq/48:coV+nKMVMGzXo1yO4Z2dSKN/48
TLSH
T1B4833AA6B2227135C7AD11E594567B01F22B17861448C8FCF07CA5D63B18E8B63B7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\73265fde-255a-480c-85bd-668af3469b9a\index-dir\the-real-index
Size 72B
SHA256 ad83dfff726a38075f8ca35ca731505b0d1ead1d8af74a1aeb2a33b4bd74eace
MD5 5fd3b1a6aef788eba6029a8f68c12d73
SHA1 7eeb49c17de3c43a49eb1b4a10126f29ecfd4a77
SHA512 50dd73f5c00acda4def01d20c625c61e2c5c4a1c7f301c176cf3cd2e68da657f52c27f20b7dc3ea52977e5834dcbd1ed768f4da764c88da55a92c0b9e7e2646b
TLSH
T115A0023052644449D4005FB0576503763714ED5B0355635B55A74456FD6119E5921340
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8db29185-db41-455d-9cfd-eb7a572d430d\index-dir\the-real-index
Size 72B
SHA256 1dcdcfbbd618481a906abf352e2a20706d76db4e90869f0cde792de29b03b49a
MD5 72bdf72227b87142568697274dd21115
SHA1 5a7ad12614785bfcd91b10f21921ca08a92af2d2
SHA512 5a4f933eb67a39e92489aafa366de53227e16ccd238f224a2da6bc2b4d2df33897c9ce2b221161b7901902d283a252cb63d073c31770dff538bc9ddb007dfe83
TLSH
T128A0021136580606D411027134E74184223C9D71A74AC205C2D8A2F4FF9B260420D040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a59d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8db29185-db41-455d-9cfd-eb7a572d430d\index-dir\the-real-index~RFe59a59d.TMP
Size 48B
SHA256 b2e7d0547272038688e08b1a480c34b0fafd08dd6f3ae37b59cd9e72052a5e84
MD5 940df0d554254d02c8a1be46a04e450e
SHA1 794495b42246134a84982dbc7c9dce0251579663
SHA512 f913c1cc957af65c85ae8c9bb5817b829ec70744cad2c4a6d01db93143506375acd0e8b56f6b8e47591f5fcc5e21c3faab7d72d3b808a6dafc94b897a0df03a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fe91ff96-990c-497c-a698-16d0afdfd865\index-dir\the-real-index
Size 72B
SHA256 e3912d4c8bf7142d676468acb1fcc1a5f2284154cdebb28a372c95eaf0a0602a
MD5 bc435a166d56f2f904fb111e56826409
SHA1 5f3bc4957ba0dc2d3cb1e916bc567fdb2a8e07b3
SHA512 906e56da360a548982c8396d3581f806fb1b1fc5fcd4eb22cf5adb2e5bc63de90548376849f02e0fb89412ee47626f1328ef665dfaade112da2081c2aa33e600
TLSH
T1CCA0027BB3A15459D023CFF015D919682351C8602B7B73137D9010EBEE942414919900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a166.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fe91ff96-990c-497c-a698-16d0afdfd865\index-dir\the-real-index~RFe59a166.TMP
Size 48B
SHA256 3e1736dd506d29bdd4b541c8392016a0feb8005aef5a1cad0967e7266d10c0bd
MD5 612bebe8ab70d3172724d933b633b24e
SHA1 e8b74b5ccead8a3c19cf879755d562adc1605032
SHA512 9e9974adc88c01db6a30e248b36b5e1ebb0958478ed2ead5a8dec16c57ec7751458ff7b0a6d36b4e812e2c54f39a02f61fd07a0b9e88a174e1f3d28ff821cdc4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 21e6bf80616098f952ffa5df8eb9969e035b2982a4217d84c6a5a694f522153f
MD5 7344a3f9d59fc788627313ca8bf3f88e
SHA1 25f7287265b4173397d8b32d9f01402e8a35f91c
SHA512 43c50548528b4746fe7ef5d9541aa01aef88fd803e2c8bd56aa4290ef89d27f87a801aa788319533ee8655b20ad946dc3096e4f17c153f31fdad157f86c38f5c
TLSH
T19FF0277A3FF72810FCEF83E664B150A14E457C548519EC5F940B75A6A07135A605DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 3d2aab88c03f46583f278d1d8675c76d33edbc2efb897a1d2cf9c00ab339fd43
MD5 f2cf3fc93681c15843714aa7df375526
SHA1 192c23b5c61b5eaab55de3ac7de4c720c389df66
SHA512 50d98110e74be5a2c0e6212d1dba245581f3b6cd008dde9784725f35a1c7cfc643acac39053379474a4534b82bef67be3423fd97c1775a0527b497f2594032f3
TLSH
T10BF04CB63FF72804FDAFC3F9207204B409467814C528FCAF951BA1965072B556059D62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 f99fca94ea6429ffa5cc8fc0402dfadaa27c9bc75bd79d5787cc961d6624cf32
MD5 cd3d6d687bce79ce4610218b24504a0c
SHA1 079ab91365cabc1a2460ca7f71926865983f7f31
SHA512 e65eef55c12610499530e897bce7660a11b1d8ae710c4759d7e6a1720d7b1356334691fb3bb03ebe1cc7605ce224b04cd31a85587bac13f5fde2ab794a64a594
TLSH
T1A2F0ACB63FF72804FEAFC3E5207200F049467C04C418FC6F841BB1966072B46A05CC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 27de3a44c781dab54d7c4fc576d4bf68be74a1f3efdc1e3d5e7153abee852d6f
MD5 773acb768dc2c782c3d66119357bcefa
SHA1 0267857f63396d2223a8e77b7efb4b2bfc43d304
SHA512 112aac7506e746e68d5e8a47c2f1c8144bbeae7ea90e53139f6e95a5d055d6f0a67db164770b328dedf85488bc73af0b4d28d8817d8ae1f03b7eed940ef4bed8
TLSH
T13BF04CB63FF72800FDAFD3F9207204F409567814C528FC6F9517A1965072B556099C62
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 129KB
SHA256 949f7fe1f4840d8336788030b902eb7834525bbcf85676ce6d2d64743ee47064
MD5 ab5ae393428a7f366835834dff2b9534
SHA1 81106d98fbfb4cb098a3b4046e64092cb5e60de4
SHA512 2307d1771a75a06b8ed5249ebc03376f4be5f761702df8a65764ccf6bbddbb704bc148eddfa3b96aa39d5bd214e7eedcc9fd9b8b57ffcc5c0fcb63efbd2cacd5
SSDEEP 3072:RFCI9B+xPCI1De0epsOL/A0PdaZMiiZL/WL/CL/1L/xL/s7CPBnoWz:RFC2UOL/pFoMiiZL/WL/CL/1L/xL/s7y
TLSH
T1ADD39933769D50AB0E89BAB45156B50392BC7467B8449038F214A7FC25DBFB013FAEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 226KB
SHA256 3e1a58173a53f3ce1cb809081c7777c560430c7426501a8d846292686a60e233
MD5 27853a0a3c9c10505c60579851584729
SHA1 36476b34f2587cd2c4f22d86df829837f84db4d4
SHA512 213dde24c6668108160612829868fd303607b0c6ce5db12c27fa55c0d25ea77abca5fd8cbcca6da81ce94526a8a54729791fb91cb243ccf42184cc0bdd2e7ca0
SSDEEP 6144:kLhCTQH0vT+Trc+RkW2C/UJl73CqSjHXwL/IvJhjSIc+Mn3xx5Nf4rVL/AL/jL/z:EAkFmtL/oef4rVL/AL/jL/yL/WL/sq
TLSH
T132342B22675520AFCE2957F92123991373B5410EBEC3D26ED2529334189F7E32ADF923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 18d081c6c1e3efa3c58d4cf69e1d1ec5e7e98f4ce0f38b72a72e7eb52b2874af
MD5 41252f3b69709ed655a3f3fd2295f8fd
SHA1 0d015040235f09320ce06e4032a8974cbf87d414
SHA512 30530b7f6a13e4740a18eabe52bbd8ed244a627de37a5cf69bc0c3db9478847a55887dd784112d4a8dc76e09e16812d62f97f4f8c443e404810812dd4a1cd25c
TLSH
T1BCB01120A80BE022C82002B020A020883220AEACC20F3002A0ECE0ABCC8A3000AC2888
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d69c778b21623964f34888877540efffa537ee1a0de7d855c9d22a04bab0416a
MD5 eeb7b6b21e2f432d4d51d117f4954784
SHA1 95f7ea10df9d68632e9e4ea157c870cf5e9ad833
SHA512 567d6f759c505b84c9e12cedbca9969592febaac8bd60ea3cbd1af0d79c392b646e3c13dd3b9b4502abc44b5b36b7e39e065de07f71bdd5a0588f219a7e1c4e8
TLSH
T1ADA002119D5A9006DC2006B01465515633A088D98106E2CA489CF5F99E97174E2C2942
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5992b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5992b1.TMP
Size 72B
SHA256 7503ba41a9d2068076115466b372afdc1d3887eccfdcc925ad4a229cec918e67
MD5 63289ef3d4bca22479ecda4a48650e7e
SHA1 e3883628b711815435bf36f278e1339296ffcd87
SHA512 9cbc6c81682e36fc6f1c76bddfde85d92e1967252e06db72dbdebc0c9979dca7a626519d0f2adfb9d01f7ec8270ee16dbfe8d3e19e8163072c05996ef5658b49
TLSH
T12FA00260DB439518D14041F425350BD41250FEAEA5153222C1E8914ECD611818681800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 321cdb9e625045d576a5e019efb9e92f926a40726988585b58de40e4c8e6d623
MD5 d5bb5729ad0bcb73434202bf3c1e67c0
SHA1 549eb5010587bed6d6bed921f8b1707b00d926f4
SHA512 47953d10f09c7fad1218623b4ca9f04296b2e60436e0775be8c651edafdffab7bfe137d6eb85e3b608e083aeced41b097c258da04c132b237f4b6772f2da384d
TLSH
T126A002A09F5B4685D4109B71A0D203822B21CD15511A435340D25859ECD05C09D02104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 3d95d5d47c19b0579748311bbae78c112c99fe7f58e1de357fcbf99f419e6e80
MD5 e6d48d4fbcff1d9453f1cff13ee2d7e2
SHA1 fdfac2e1eb799e2ab5b871909210b7a54d0d8108
SHA512 02e0f6b58c2b572670beb4ec04809df0f71a6e2c88acc5994f61332b237c9b4bc30157f620a915215813e51c791f41d7eb39e48a72b9751bd04d12f10590a00d
TLSH
T13BB02230AE2C02CBC0200FB0C0CE0BCA3B30AC28230B8B03808E00BCFCA03E0AC83000
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 aece02f443ceaa56e8d296c1c4cc2ba0468c457191489bf92199b444f014b57f
MD5 8386b4df735938c8e6d7435a13f60e87
SHA1 98327ec94b04dfb2a02d6aa74fa0aa87e89e3fbc
SHA512 1b762fb0202e6a7520e53e75df6f4558abd0f030f4d9e901601e2af20860c37f46353272bdd3d029f8ab468a887b5774099d972b262bb46b75faf38dc7d5d40b
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXO13m:OtfFvpopPxrB4RhfOVm
TLSH
T16CB2321571BA021138FE790881B6972F064232B37158E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8f5a3c5516f12057e644ffc28063403d569fc6edad489dd44a423a6e82698e6f
MD5 f8a14c7fafd3e8f7093314de4c7cdd28
SHA1 d821eed13cdd24d99dea9095f1a642c3c0afc7d2
SHA512 663b09aa7df3a632dad3176f624dabd57d574712d6bd161113f5dec8f93cbf9f0028661f06fdb8caff768f49532c82e4a162771247e55a15fd43d392008eefb9
SSDEEP 384:nSiFiZcIssNr8TUNTUlI4HTXmgjSw2K2fLBgaw4QRsixftgOIwZOyRfgL/7Iz0oa:ZFQs6wgLRwKBbw4mFfXsrB
TLSH
T1D7C24A36E898DABBFCEB8A95B74A7603DEF04163858C9AD4D5D95D0D00DB1AE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3b96d56a6cd50984fc0586c9472119c35d5e39b534e8bd75241ebd74ce3d5c0c
MD5 5eecf68dbe490ae8002a6a287f1c7d18
SHA1 827fc91970d257989d4da39f4ddbc3d7fccb0124
SHA512 c57cc1878faabdca6487e8c8aecd32c7b01edffdb721c233801eb2b0a8943f3d4e9a4ab4877d3ecb6fd4e62b528c0a330a40e56c39e039ae7e1ac9ba33d1976e
SSDEEP 384:nniFiZcIssNr8TUNTUlI4H5mgdrvK2fLBgaw4QRsixftgOIwZOyRfgL/7Iz0oa:iFQs6wg38/Bbw4mFfXsrB
TLSH
T1F4C24A36E898DABBFCEB8A95B74A7603DEF04163C58C9AC4D5D95D0D00DB19E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 88e3daed84716b6a46e98b004be09ddb8e0b5dc2e59765cc472859eac367b409
MD5 1ee13bc03ccc0fb3886e628859061f79
SHA1 91a9ec21c1b64a3918eb7295f3445383c3d4ac6d
SHA512 c11b1572f434e377658620ff26059a044e1613a7a4df7ba1ed17d85ad6f7e10200bbc6c9db9f7bffdcb5653a4625997100501418dc07c5fc4d2766378b3f6f08
SSDEEP 384:nZiFiZcIPysNr8TUNTUlI4HTXmgjwbK2fLBgaw4QRsiAftgOIwZOyRfgL/7Iz0oa:wFQ66wgLvzBbw4mcfXsrB
TLSH
T131E2B4F598D789BAE8EE4787677D6D0299FCC153B5885984B7D80D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b64a934c36a073ca0f5c7d4a4f52209bad679bf17c150afd4202047d9914a2bf
MD5 551d59095f327e80b3d88796459b30ce
SHA1 8eec6a3df0bafb143f14af31d6aaf4ec0fe89f6f
SHA512 142249e8f95d098afc69aba1ce821225d857d8ff549bf2c89372a8f022077b73c62605d873cc060afa39d99a053379c5a4be9a6051f1921229dfce6e96b72b1f
SSDEEP 384:nZiFmZcIPbsNil8TUNTUlI4jTXmg0wbK2fLBgaw4QRsiAftgOIwZOyRfgL/7Iz0B:wF0zTlwgPezBbw4mcfXsrB
TLSH
T103E2B4F698D789BAE8EE4787677D6D0299FCC153B5885A84B7D80D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2189fedcf264e510595ad40f164780bbebea00b3d320f2d99a468cf4112b968e
MD5 eb96974be69c98d4a0907c4ed2ba84ed
SHA1 fc26b1818b260f4f5233af0000f79d2f13cbd8f0
SHA512 227eaf0e4fd80ba9d06a1a650d6ad7ac7cdde85cb5c5821d981195fac93891b4ecf7e15772135b2d2d29a459f88704ac2ab9315eb584bddb6c42093902ffef40
SSDEEP 384:n7iFiZcI63sNO8TUNTUlIm25mg5/nK2fLBgaw4QRPgsa+VYrgL/7Izaom:WFQ63XwgSs3Bbw4mPghgXh
TLSH
T112C24C36EC98D9BBEDEB8FD5AB4A7A07DEF00163849C5AC4DAD55D0C008719D1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 21529b712549539e7e6ccaf468ecf871e09f929e31af978e3e26bf064bd5737b
MD5 547c80730dd81915bd1a583a02ef50f2
SHA1 601bcd215995e08150d028fb0f259d3f99afc9f1
SHA512 7680e57e592a613fcbde20a99de88bc362efcd78d1cfc367a65970bf4e2fcea96bb7a65fd58149693d437cd873b768e7930b74936ba44a0d5d7c57c79d9e4644
SSDEEP 384:nZiF4ZcIPUsNil8TUNTUlI4jTXmgcwbK2fLBgaw4QRsiDftgOIwZOyRfgL/7Iz0B:wFG8TlwgPqzBbw4mvfXsrB
TLSH
T131E2B4F698D789BAE8EE4787677D6D0299FCC153B5885A84B7D80D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce9e824af1c80e70fb419ed479371ad3e2aa48b49feb00c670bf95c9a0bc8d31
MD5 c7fd7ac78d8f3ab882055b6d3f9b9bd8
SHA1 cde4e0c41718571067dc624a16879421b72cc76e
SHA512 14aa33bc0f73d4bbb80710ba44cef8028a0eeb1ba458b67b8d8524c40a247b9c76d7cb7cafd966fc69055ed047bbd9f0e2adaa6a442b26b0be39320530e44b96
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 af4741edac46d241b9a39042e877d2bab4407408bbfb8c930793dbc9e3ea3c03
MD5 1085880844fa1142bf775a3b5eb2b2b3
SHA1 4b8447124d0377be759884d0d269b0b16c73c35d
SHA512 347707a044376230866ff8f08ab7ba83edc1410e44069c817634ed5d04204739a97b58635bf421fc8c3458b836e3d27723e6be555296a23e15708a72dbd897b3
TLSH
T1B2E00203D30000FAC128033000CB27766FE6C02002F303465D2002683C273002E70FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e414439f4933a8fb56be290b08e7bdf7da743e015c0d893aeb1b745c95a004a5
MD5 fe388702dc8ac00dd291aaa6cee1d74f
SHA1 aaf197fb8d31e111e843cd96efd2178b074acbef
SHA512 c0e51226b3c444e966ff7338a2de1644f7a437ab54d52da83cd44357523e9ec386a7734b2d0861639ef8e510381e3008a9ef5b057b8ba66525a5c7faa5da40fa
TLSH
T1AFE00102D60040AAC128033044DB2A766EE6806402B20255592442683D273002AA1BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe595f0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595f0e.TMP
Size 392B
SHA256 0a755188e0eb116c38a50415e915426e832c2c50e71beb285f8437149b131e9b
MD5 1f247caeff287341880091ef02a829d0
SHA1 b7025b09f1f78a127ba918657ad85ea93517dec7
SHA512 c4958f4d027e8108df09d34ce376a69b37215cc05a28dd1f5a3c5409b5d90bde3a54ef2742efe1e9a8bfd2f943e13945b8858dbebeac08dade6ec81b2809fe96
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d6a798df0d59aa2e36c5b7249d5e10d35ca3265bb9deb775eaeaded91add8ed
MD5 74a844b8ddc8fafced6fdc708e68234d
SHA1 f918179e9d7dddde2cde3bb7b8dbec0b0e9a431d
SHA512 4757a5a2f461672001e8cfcd6de15459890eaa6249849a18024434386db5c5e48a40bb38190e5a7c16cdc794389d823d529219de4cb941d970911dbab158c03d
TLSH
T1CA41185DA7FE1108B3B66E5AAFF6A46E487AB8772F0BD45D00010E4F0A36A40C871733
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp706A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp706A.tmp
Size 2KB
SHA256 108f1dea253fafcd7f13dfc98584eb40392d5f7cf3fd7fd1718fa11786168992
MD5 922b205cf2b77e4912bb2102ade3a41c
SHA1 d121ec2d3d0542fc645465a45951aff8ff59a64c
SHA512 274270eec6c4d102be166c81593867bedf231dc073c855f78612ae9f0d852cfea0fb325c6778277a77e2b9ab9c66e091af8a11b8fdcca56ef845f3e937abe245
TLSH
T18151190B0FAA431C5C09E58D04F21E5FECA48B527FA0E50BB2225BE89589934830A2A6
MD5 SHA1 SHA512 TLSH

Submit Download

rthost-diag.log

Path C:\Users\Admin\AppData\Local\Temp\rthost-diag.log
Size 1KB
SHA256 fc948dc029f45c848eb790afb67a5d6f6aaf6a8374731699ffcb5dc76497e683
MD5 56e8cdcae6d7a5c8337b19d1f7eb5bfc
SHA1 08ce86fd1ccb364f5f6829a60cc7660f3ad3c7f1
SHA512 08b59118ee7982fe7365402dff87d8b62ad26ebb2ff40e57643653f92a9ad6ecc65508e4de77ede21319c8dfa77a670404f673946b2ecf053cd02ad78f7efdda
TLSH
T1BC41D1AF901450FCCFA10161F173779B79C6B1B805C9110977E772AD11964E6D64DB1C
MD5 SHA1 SHA512 TLSH

Submit Download

rthost-diag.log

Path C:\Users\Admin\AppData\Local\Temp\rthost-diag.log
Size 3KB
SHA256 0d46640616daa34fe5fdac33d1c2c255c8ee0a00a73a37467bad96e8b4c389e3
MD5 4f3b3ac4295ed6123719f73b4a25b113
SHA1 f95657b65ce7e6e9a97acca87e36cf9c3629b210
SHA512 b078d752278bb040871af093b1e00893e6d0b07fc10819525f131d656d2a6129454f002565f6c2b98ca4851917717af1073c1b66f569333ecd5b3169ac6f81d3
TLSH
T1C371BEEFA01894FCDFB10191F176778B3A83B1B808C4121D27A976A910E69E6928D718
MD5 SHA1 SHA512 TLSH

Submit Download

rthost-diag.log

Path C:\Users\Admin\AppData\Local\Temp\rthost-diag.log
Size 4KB
SHA256 07437a7280f06e43e5d4d94d1d5c8b4abca6b02dced4b97a5ddc47fec3e4a07e
MD5 9d8e0eb8d531e7d7302b248252c25fdf
SHA1 20cf67725c881f99e0859777feb15b984d4df3ab
SHA512 7c479c5e6f3eed03ed840b415a386b73c1a0ff5332cf5a7cf5507a24009ec516e52e801f2aa505f8f23d7c6729cafa14c52174277b1609a1bbb59bb82bca1076
SSDEEP 48:EA9MNHX3pphjImVDmgNHVoD7YVvRBat5R8fR8lO8YT2snVocVGZOnxy6uqN:6VX5phj9DfHVoUjQ7o2lPtRHquo
TLSH
T1EC81BEEFA01894FCDEF10191F276779B3A43B1F808C4120E27F976E910E69E6928D758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-713.exe.crdownload

Path C:\Users\Admin\Downloads\winrar-x64-713.exe.crdownload
Size 3.6MB
SHA256 dbc951b4ab01646888b2a91da73a94dd920054c2f27c8cfeacae3eba298e71b0
MD5 53ef4972d65304468d2519aa692001c8
SHA1 095036f9669230cb69b42eb5e6d91fdbe46ab61e
SHA512 3be4a4f1715a06863d552d726549268ae38327023d92b43767c3f71bf34a8f1f46d3d2788218831716016438bedac057068dedf4698cfe6d7ad9024bba49c46a
SSDEEP 98304:cRZBAYtCkpjsMig0xgsXzQZ5exHkZfqXdl/X+S2H:6RM6S3LXzWexPX/X+R
TLSH
T17C06231DE79418F9E037D238CD934506EAB2BC9D9B71C68F23A515A92F237A09E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/116-2026-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/3460-1998-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/3908-2018-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/5032-2022-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/6248-2054-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/7092-2031-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/7628-1970-0x00007FF62FB90000-0x00007FF631B63000-memory.dmp

Download

memory/7628-1969-0x00007FFAF95F0000-0x00007FFAF95F2000-memory.dmp

Download