hxxps://github[.]com/inlovewithsex/XWorm-RAT-every-version-cracked-by-R2oy

Resubmissions

28/06/2026, 09:17

260628-k87csagw2n8

28/06/2026, 09:14

260628-k7ew5sgs7z8

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/inlovewithsex/XWorm-RAT-every-version-cracked-by-R2oy
Sample260628-k87csagw2n

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
179	4704	msedge.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	winrar-x64-713.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WinRAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WinRAR.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
5240	winrar-x64-713.exe
7192	uninstall.exe
7424	WinRAR.exe
5636	WinRAR.exe
7752	Xworm V5.6.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240710734	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-713.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271118543907072"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7752	Xworm V5.6.exe
7528	msedge.exe
7528	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
7424	WinRAR.exe
5636	WinRAR.exe
7752	Xworm V5.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
7424	WinRAR.exe
7424	WinRAR.exe
7424	WinRAR.exe
7424	WinRAR.exe
5636	WinRAR.exe
5636	WinRAR.exe
5636	WinRAR.exe
5636	WinRAR.exe
5636	WinRAR.exe
5636	WinRAR.exe
5636	WinRAR.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
7752	Xworm V5.6.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5240	winrar-x64-713.exe
5240	winrar-x64-713.exe
5240	winrar-x64-713.exe
7192	uninstall.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4408	4448	msedge.exe	85
PID 4448 wrote to memory of 4704	4448	msedge.exe	86
PID 4448 wrote to memory of 2424	4448	msedge.exe	87
PID 4448 wrote to memory of 2424	4448	msedge.exe	87
PID 4448 wrote to memory of 2424	4448	msedge.exe	87
PID 4448 wrote to memory of 2180	4448	msedge.exe	89
PID 4448 wrote to memory of 2180	4448	msedge.exe	89
PID 4448 wrote to memory of 2796	4448	msedge.exe	90
PID 4448 wrote to memory of 744	4448	msedge.exe	91
PID 4448 wrote to memory of 2796	4448	msedge.exe	90
PID 4448 wrote to memory of 2796	4448	msedge.exe	90
PID 4448 wrote to memory of 744	4448	msedge.exe	91
PID 4448 wrote to memory of 744	4448	msedge.exe	91
PID 4448 wrote to memory of 4728	4448	msedge.exe	92
PID 4448 wrote to memory of 368	4448	msedge.exe	93
PID 4448 wrote to memory of 4728	4448	msedge.exe	92
PID 4448 wrote to memory of 4728	4448	msedge.exe	92
PID 4448 wrote to memory of 368	4448	msedge.exe	93
PID 4448 wrote to memory of 368	4448	msedge.exe	93
PID 4448 wrote to memory of 4948	4448	msedge.exe	97
PID 4448 wrote to memory of 4044	4448	msedge.exe	98
PID 4448 wrote to memory of 4948	4448	msedge.exe	97
PID 4448 wrote to memory of 4044	4448	msedge.exe	98
PID 4448 wrote to memory of 1444	4448	msedge.exe	100
PID 4448 wrote to memory of 4980	4448	msedge.exe	101
PID 4448 wrote to memory of 4980	4448	msedge.exe	101
PID 4448 wrote to memory of 4980	4448	msedge.exe	101
PID 4448 wrote to memory of 864	4448	msedge.exe	102
PID 4448 wrote to memory of 864	4448	msedge.exe	102
PID 4448 wrote to memory of 3936	4448	msedge.exe	103
PID 4448 wrote to memory of 3936	4448	msedge.exe	103
PID 4448 wrote to memory of 3936	4448	msedge.exe	103
PID 4448 wrote to memory of 5104	4448	msedge.exe	105
PID 4448 wrote to memory of 5104	4448	msedge.exe	105
PID 4448 wrote to memory of 5104	4448	msedge.exe	105
PID 4448 wrote to memory of 1336	4448	msedge.exe	111
PID 4448 wrote to memory of 1336	4448	msedge.exe	111
PID 4448 wrote to memory of 1336	4448	msedge.exe	111
PID 4448 wrote to memory of 852	4448	msedge.exe	112
PID 4448 wrote to memory of 852	4448	msedge.exe	112
PID 4448 wrote to memory of 852	4448	msedge.exe	112
PID 4448 wrote to memory of 1904	4448	msedge.exe	113
PID 4448 wrote to memory of 1904	4448	msedge.exe	113
PID 4448 wrote to memory of 1904	4448	msedge.exe	113
PID 4448 wrote to memory of 3020	4448	msedge.exe	114
PID 4448 wrote to memory of 3020	4448	msedge.exe	114
PID 4448 wrote to memory of 3020	4448	msedge.exe	114
PID 4448 wrote to memory of 1700	4448	msedge.exe	115
PID 4448 wrote to memory of 1700	4448	msedge.exe	115
PID 4448 wrote to memory of 1700	4448	msedge.exe	115
PID 4448 wrote to memory of 1336	4448	msedge.exe	118
PID 4448 wrote to memory of 1336	4448	msedge.exe	118
PID 4448 wrote to memory of 1336	4448	msedge.exe	118
PID 4448 wrote to memory of 2168	4448	msedge.exe	119
PID 4448 wrote to memory of 2168	4448	msedge.exe	119
PID 4448 wrote to memory of 2168	4448	msedge.exe	119
PID 4448 wrote to memory of 5136	4448	msedge.exe	120
PID 4448 wrote to memory of 5136	4448	msedge.exe	120
PID 4448 wrote to memory of 5136	4448	msedge.exe	120
PID 4448 wrote to memory of 5148	4448	msedge.exe	121
PID 4448 wrote to memory of 5148	4448	msedge.exe	121
PID 4448 wrote to memory of 5148	4448	msedge.exe	121
PID 4448 wrote to memory of 5696	4448	msedge.exe	122
PID 4448 wrote to memory of 5696	4448	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/inlovewithsex/XWorm-RAT-every-version-cracked-by-R2oy
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc1aaac188,0x7ffc1aaac194,0x7ffc1aaac1a0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,11811271452298484673,13104770180522610231,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,14145448899692599345,13010772689208593431,262144 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,6154893915643283481,16441993391536044484,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,7563957226805237898,8049565327276222124,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,7479021100954191644,8417821563470963784,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1585800313842682518,17892719519394829609,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,2744781061127193348,12913087839591784995,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,5928539993273931622,8759797352480775708,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7129147517139641451,1928975320450852075,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13027593789486307064,5536761014022136769,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13027593789486307064,5536761014022136769,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6240,i,1618331133556119367,13014949087493433681,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,14068304318844505846,16404986399703653379,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6624,i,1966818739519340732,3959833895419549023,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6960,i,1424908234043468603,15229621419340307367,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4268,i,13690306373862861753,13818155481283698127,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4236,i,948278643724880216,4456528133819405032,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6756,i,5204351732876691872,11683227534835643807,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7140,i,12158018525598981845,999169783434393139,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7164,i,15321793100903174442,3118970258482239794,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7448,i,938683766861374892,17293489419503178792,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7564,i,2716203863890363103,4003330514150435169,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7716,i,16626366055355651146,9092803820807042900,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7836,i,10624646166081296392,12601198015721483956,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7300,i,6306137761977813647,16913497029493914233,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8092,i,13605238465027173165,14113351041527693630,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8236,i,9838088039879875811,13746519922893209350,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7296,i,5907166271251092522,10218644505681576883,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8292,i,5240769919444474863,858822996065611516,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8296,i,2455971428299247177,12997124426986037211,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7276,i,4383140418777036891,12618492457380543350,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8952,i,537458605521890528,4115186423089991575,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8964 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9100,i,6606046527466717227,8852549197274585791,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9324,i,13306211140831326572,2286299047030664056,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9444,i,2597397571839867186,12364568031772890809,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9276,i,10456023140531466666,1292375262589134617,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9780,i,16595686573910325463,15303051372835360786,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9816,i,9822098108050777756,14134414148708658014,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10048,i,7655301662338010484,14460273708826129157,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10196,i,6154180451813568363,10658211120677540653,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10208 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10340,i,9455776081809663376,14514459751783184252,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10352 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10492,i,24522475167985669,17418405915362142581,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10628,i,8794082654052551293,3024514554892632447,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10644 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10772,i,9361478696738241517,18138942005193689573,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10780 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10788,i,7840147089294731760,826549306244248604,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10932 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11060,i,10985531240447911505,3985443537777158593,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11076 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11204,i,15907746588206394693,11652733030500832461,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11220 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11352,i,3785783244283594837,16824888677043996651,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11368 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11392,i,1889438442832811283,15836029249621789886,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11516 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11640,i,12564285236715005478,4111232708984802770,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11648 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11536,i,12218855037500956079,3099758696899126963,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11800 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7744,i,16310067045331149706,14673536035044974444,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12048,i,18005325245390229399,5590115079225876384,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12052 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12180,i,2358047533417258320,6364189033871800969,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12184 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12336,i,12343880890743010813,9583911518386585641,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12212 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12472,i,17905444124174901578,12183721548710972990,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12476 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12648,i,14174467917373886028,18301867186638668447,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12480 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12776,i,17015393654643738025,13410177578249816764,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12668 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=12696,i,17564458648196504808,12805857338653833312,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12920 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=13060,i,2568306754625321024,14218371652914129037,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12936 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=11696,i,6672867673472315353,8055393089824155508,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13420 /prefetch:1
  2⤵
  PID:7536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=11660,i,1631278924870930720,13769392502574188770,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11744 /prefetch:1
  2⤵
  PID:7544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11432,i,17757780357905110943,15779702259250520026,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11720 /prefetch:1
  2⤵
  PID:7552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11772,i,8021207614390700648,12169218697331451183,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10144 /prefetch:1
  2⤵
  PID:7656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12800,i,836207708044960484,11506195298345791866,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
  2⤵
  PID:7668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=13484,i,11905556032335888679,4568139388984307588,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:1
  2⤵
  PID:7768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10968,i,9266778022240926218,15160148170265678004,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11992 /prefetch:1
  2⤵
  PID:7776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9120,i,14083014263105042131,12187925537056195657,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:1
  2⤵
  PID:7988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9900,i,16519442230982297850,13945409784375915561,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10772 /prefetch:1
  2⤵
  PID:8024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7564,i,15029674707178055099,9946344462379630257,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
  2⤵
  PID:8048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=12760,i,5296716763177974448,15557495329350812885,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:8108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=11848,i,11384862193711288209,11438452265325123552,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13544,i,2510201283200176975,4359447981268955952,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
  2⤵
  PID:7112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10900,i,550987547107176121,4445950248998959120,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13504 /prefetch:8
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11868,i,9626207904894831988,13054884187910286477,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10632 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8832,i,7265760221891977853,11701354895393926129,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10808 /prefetch:1
  2⤵
  PID:6892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8324,i,2250020306821396977,8754878428170216238,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:6968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=7504,i,12939328049925113017,7851775063782611977,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:7172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=7452,i,5851420835051286723,17780573169074927904,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8300,i,6718709091988490017,4137027490675011456,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9384,i,2935660734909885295,826321664437483236,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9372,i,4738455453995408627,10737191318596950962,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:1
  2⤵
  PID:6148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9288,i,6395181004219895251,18083725208396867048,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10092 /prefetch:1
  2⤵
  PID:7856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=12760,i,16113398303274739562,5881318138715120827,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=9304,i,2834839451145015966,14309725445829902164,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12216 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=9624,i,14377914264208084804,7408936120564279220,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10996 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10748,i,3695790438683081968,3895854469009388502,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:1
  2⤵
  PID:7140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9904,i,3884556118683579974,9942707053298390782,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:7808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9764,i,11944772886640594455,14987570355438908927,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10728,i,6317616846030431724,6358707879456008410,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10828,i,12296495021493449012,3079011767763162711,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:6288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=6780,i,6819341342444844247,434614556230939616,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=8804,i,2834668061935540911,7720448844226820146,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12400 /prefetch:1
  2⤵
  PID:7272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=7824,i,11716782199109228395,12639478160375944461,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11512 /prefetch:1
  2⤵
  PID:6480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=13648,i,1280443280523368907,13233347230981847352,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=12184 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=12644,i,12164314952917002199,13857873343919339637,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9620,i,17605861440691755924,16141659742189422005,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13132 /prefetch:8
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=13168,i,11971220999520225803,2434512029152068811,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13112 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10728,i,8362376196931924411,8135814712925015628,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10648 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=4492,i,17267615787847501113,10534920731732341428,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13216 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13528,i,10865120290027944537,8817603426903743312,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:8
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10180,i,12715648903657018889,17460628457797079985,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:7064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=13604,i,616049851228365946,9884304479244743517,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=9364 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=7040,i,13506961950710004995,14544191569557755479,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=11696 /prefetch:1
  2⤵
  PID:7496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=6624,i,8166218555490837104,4313487609333986854,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13808 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=7640,i,9658791423311490383,6549680139971400551,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13396 /prefetch:1
  2⤵
  PID:3112
- C:\Users\Admin\Downloads\winrar-x64-713.exe
  "C:\Users\Admin\Downloads\winrar-x64-713.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:5240
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:7192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12604,i,4662164290072411462,15822216673607722957,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=13304 /prefetch:8
  2⤵
  PID:7948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11048,i,7891272012904653867,6462065932734176407,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
  2⤵
  PID:8000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12484,i,9406545079312791371,2569852709014765342,524288 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=10252 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\XWorm-RAT-every-version-cracked-by-R2oy-main.zip"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:7424
- - C:\Program Files\WinRAR\WinRAR.exe
    "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\Rar$DIa7424.45821.rartemp\XWorm V5.6.rar"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Rar$EXa5636.46488.rartemp\XWorm V5.6\Xworm V5.6.exe
      "C:\Users\Admin\AppData\Local\Temp\Rar$EXa5636.46488.rartemp\XWorm V5.6\Xworm V5.6.exe"
      4⤵
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SendNotifyMessage
      PID:7752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=5212,i,8633254259198680380,9255021865597100992,2097152 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1216,i,9526669304959465685,9620359260365669704,262144 --field-trial-handle=2276,i,9626430500655490710,10574612900068920264,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4516

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x420
1⤵
PID:6752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 39baa167de334fef185ae8b97e8c709a307eed08e80fe115577c59a05200a13a
MD5 7c7fadfc3884853fe0141609fdb1e624
SHA1 36261b2b3cdbce62b6a9d3139a6c239467a3006a
SHA512 1d868f5665f6ca182d07bd21ee0e2158cd00062e2633c4845eaf31a242d5868f79f833fd37f87b54f17adc63c7804b95c9d3bcf66c137484f2615992b69ec0d8
SSDEEP 12288:Kxytky4LvurgzH9C/2qCQW7oIIvS5ejcwU:Kqky4Lvurgz62t5cYwU
TLSH
T1CD949D19E7A455F9E5B7D23CC9924507E6723C51CB71D38F03A10A9A2E237D09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

469a8e37-1590-401a-814e-9e20cace7b32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\469a8e37-1590-401a-814e-9e20cace7b32.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000f3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f3
Size 176KB
SHA256 6137bb602b2e125bff2f7e6cb56b165e36b02ef8dc1edb299a19c65ff4c1fd06
MD5 43351dc56894546247c48b301876341f
SHA1 9fccede217fa7cdca9943402fdf00b6450792235
SHA512 64ee8af34295f68fbe4cfa802235253a2996aa00e2c02cedcb164bd55cfc2f4cf8340c846a3e6f6c3855497f813598b89e2e5dd6de89349c09f853a820be722a
SSDEEP 3072:oEk2aVDNWaSTf15HqyEF4RuYYLzZbhjt140hUUgPNYkDKAm0OtLuh2ASH6TiQu/D:4caS5HgEu3lFtB7gPNXDbmnuh2A9u4QL
TLSH
T16E0423EF3A1F81ABB0951D042F5AD6424654DA7B21BD9DB128C83D7C33219D1FF9502B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f4
Size 140KB
SHA256 532ac4e24257d3be7ed6643b330cfe8c60702284ec9681ae87f968943a97ca3e
MD5 e453f46e4a83566789fd9ee55dcae02e
SHA1 31641c728c48567f9fe2a67a73d67ae1020f280b
SHA512 67c10403c1fe2c8a849c5d22037c03414cd594c89dcea10d7b76223349c31e0c7e04170d8730f39d60d7f20b92531f2a0b3f881ffc044f677e62e8718c78e1dc
SSDEEP 3072:WbqUD1XICkEQueJ2dEYPIgrOAJdudorUkFKi2/XObBy+wFtGWV:WcliOAngkFL+Y2r
TLSH
T1BCE312B5B5E7DA4D88DE042E7119AB5F4797478E3730ED23887A1AE09444343F94C6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f6
Size 118KB
SHA256 f50e71fc6f8b1a958df285857abf28ac4d614d82803888f23a0b111fbf7c69e7
MD5 a98f99a9e4e67ec8569ea34ee6cd2545
SHA1 249ab3caa3d576b8fd9a6eef826dafee19402d78
SHA512 0344ac81b563df98c06efc8fcdfb8649188c52e40f84bb36e07f93d86cb5ebd7c0cee27f842dd3d9f822bd21af396d5fa2a6380a086c089f2431919dbd7ab669
SSDEEP 3072:3CeLa7vYkR9x9TNftR3AWEvLwTn2P7M/3ENFmx7xeuxl:3zL0QkLBoWEB83ENUZxeKl
TLSH
T150C31247A688CEAF39C0409A415C666FFCAB7BFC86C234504CA50FE736CA3D9795251E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fb
Size 29KB
SHA256 6a50baf2ac21399ff70deacf69cf0434f8ae228da58e7e3ece4900619675ec8e
MD5 7bf0613876aeefd4d6c1c789e0cd49e7
SHA1 180a3d95f69ada192ab46e0ccc01fa00a03c3e3b
SHA512 049b88c765a17fbec42ed1c275126cf1575116f41aa3a01b9fe3fbf0ee4bdee94abb2e23169fc139f2e455f7c323ab4004dcd441750452d323babec69808cc29
SSDEEP 768:Z/Fv5aZ3n1iz5r+eRRUXSkBuqZSnFTUaWXdhHLZjR:VPakaeRRiSkB5SxeZF
TLSH
T166D2F1DA837BEE216EA40E2F1395019E193498413D5012FAC69BB9B60FB01DF8ED6C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fd
Size 19KB
SHA256 5bc4cc4dc86e429165d7acea0d6ae3b104e394c39bcd2b226401b56f187e1296
MD5 5b8f1af3814f217387b555002c24493b
SHA1 cd41ce627aa2979557fe9f5e25b3784d61346d72
SHA512 ef1e2641f518c64790c2729c6f533ac598fa7ad4579b94e8ab98bfc26cbec86aa0b224d655aa80ea9108011cfd194678af55c6617cc80911386cbb450f9cf507
SSDEEP 384:ZA/Tlx3UyO62vmyXaQk3u//pN2moQFzBD6cE5ri8Emnq6eaH7lGvWgVk:K//kymwQLN2lQFlD6t5rnnq6DeV+
TLSH
T1E492D0DFAD97BF97B51D33870AD8F82E839B551D99B23005BA93D91F8C44C198C9850C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000101

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000101
Size 22KB
SHA256 7476553a0c442bad7a88d2fddaa49acb67819516d4db4db372cff48112cd74e6
MD5 e5a1d90c4e66119b065592499d865c6d
SHA1 d26c04c242747c06b0dab83589e88c090a5e2e40
SHA512 09ababbf05ee82dde234c956e5d733eb0d1ce19e96f4464ba85eac1cd39fed227c2dee0e449f8c362084557fe06195bee8c08595bd957792b56fb1a225910e00
SSDEEP 384:IA2t8ns7JBRNvrczQFnCsbGSn3K6u6PqJTJ8CSpJ6l5GMoEYMKv6kUdgzhIp5WyP:I/7JC0FnCsCwuGqJTmCSI5K4amuhMVP
TLSH
T1C8B2E012B6AAB1ABBFB2435401AD1667F8389D090BB5CD652B404CD2F96332F85FF650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000102

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000102
Size 24KB
SHA256 f911338114dd30e83970ac2f47d1b1f1c0ea40c229bb1d1f4827562ed48bc654
MD5 e0b5af7eac9eba4d4b74643e05923f59
SHA1 b73e6142cf654305f4358b9acebe90094ef61673
SHA512 b225ba157e49e9c10deb9f5d3a0c9d3d59e77cdbcca196169d7291f8b828282335a18c45aac67a52aaffb92b6a6a50fd43284091d645f790d293e9194ef5eaa2
SSDEEP 768:ToeLjct8DEqSQa4uicKUGGaD4VDBbbGJns:T6qSwfU+k9Bbbus
TLSH
T1B2B2E19E21F8489882701FD207FC9E36E55A72BF71BEC647F5B9022E20507682D93766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000104

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000104
Size 21KB
SHA256 42d4e8f1a0d2f0529ef1bedd2e9652c257f3244f1f008deb9360694f09afadb3
MD5 e677f3a0ad6e120a1000c5ca6be38f98
SHA1 2077b8f2880ff8c33a9380e4aeaff6902266484c
SHA512 a15611104ebcdb197b597c4cab3221abdc9ae28986e5dcc6a1749c8ea77ce8a0869161c1ce93e7563be2ee10f08d3d0bad0915e33224f3bcc209047af6017c36
SSDEEP 384:xxIa86wNeXcY9R1K/2zASArFAsz1KE0/rg+N2eRYYy2VAWJflJdg0vpVON/le24f:zOne1D1K+6FAsz1cv1YYy2V3JflA0vpF
TLSH
T13DA2E1C161EA9F7A8A614481BF1493E3425C5FB86F34D981B143C7C74150267BEACF4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000108

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000108
Size 169KB
SHA256 5dad0e587e1764396369ccaef49d31431de1a5a36eefc7b72db014523f39dee3
MD5 5fc1dcfcc77f3953444c4b51544ea8ab
SHA1 72a12b151bac05ee1f6ed2e5133de1b500c7fabc
SHA512 ec65b508106e49073b2f79e7546a8b887f3930d8f1f0ba9d4522d8a91c4b0bf1f83bfeced18ee476deeaf9b6b7690a24ac61cebff3c30850f488aca6b02fa9d0
SSDEEP 3072:9Q/HElNUSxGpFQWsrDrX5Oa9dD4yx5EWC1tQ12L/4FIitR6U7XH8p2jb55Lk0:kHSsnQWsrPXV4yxGW4i0LxhUjd520
TLSH
T1D0041238A980A21C7F76D1F41D01C29C1D261EFC66F6E03BB6FF10F25A2A052142A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000115

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000115
Size 56KB
SHA256 00eef56e3889840ad4980e06a5a30513130be905fa2dd1e4153c90c32ff011aa
MD5 578d07358bf0f721918414f108666e26
SHA1 d236a9d6ed4724c3878b9e986896ae910ac08ffc
SHA512 698a9055de86dab8ab60d7e77bf6678f6db9f37c034d09e9fed88513ed60b85091a12717f6cbc503f1149f48064b4f0b3bfc33f833735ca5b96768ede71e2d0f
SSDEEP 1536:bI6hcfsQiCUBnEcCC+V3I295ZljU/KxJ85:VFQiCUKD3I2Ddxq
TLSH
T1C843024C269AC070738BE5DCDD7071CFAB3C27B6088A653A4DA69B4DBE238D6790457C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011a
Size 73KB
SHA256 5f66ef35f19e1bc8bfad52e2139ad510998e759dbb99d825f7876b8c3cdbdee6
MD5 3cacf51428fa145226351f4db893235d
SHA1 e65afd58ec5d9e1aada6996d71482ddcf9f9827e
SHA512 20df0266b4f3f351d860c174140c8f8f730a97b47f4e1fcf71e28503e03a460ff6df97614e48142bb52ff71e5d4d285da3c6401330287a50d7cdfa551448d23e
SSDEEP 1536:kkCI+9iACUcDsSByHXFtZiqVU3/+hnVVtRq+1z0hpTI+AuXkx+R+jy:W9BtcDRyVt8gnVVtRq+J8TI+XUxlG
TLSH
T1AF7302753BBF4E1A45D6FCC453E344184BF578AE6D65EE9F62A3C90EE831C46C00A292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011b
Size 21KB
SHA256 425c0713a8176f92273d378599c7eac57de7fafabd4bd0ed457b70eb8f80d371
MD5 4279528ce0e7dc28919e6f8ce5f0eaa5
SHA1 a0bec563643727d81bf21d0acec08227d9269da4
SHA512 2b6a62ea544e93669893bac8bb8a5233d55cda9c3b293add6f312808cdf5127822446a516b66656cdae7409c5938ad1ff4fe0a1ba48e52134e141d6a78100507
SSDEEP 384:74kazv9DMAYqVNsLRxmVN7UX3oC4JjImMex3viFG5Bt7/br6CfY/lC7:7fazv9DM2Q+I3oC4JjPb30G5rtfY/87
TLSH
T10AA2E187B3EAA46D5787B931FA0A1900B8FE73F65D27DA6484E087C9A1456C48C3DD3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 8241f7007a3fdd27010faa42c5f6e6f5c8fba5456887541c315be1f2abbf5b92
MD5 c20d0b381ef5043db46f526588a2385b
SHA1 47308318abfa83c60d4b69997420291abc9b7014
SHA512 b6084145f92304f15a7fd81f6adc2d94c0def8ab6168d6d08d1defb846cd87dca23df56944ca1893e262663072463152c2005c316f1ee4bee98c431fd35d91ec
SSDEEP 384:WYQ0wAJuGNI1v6uanuspwYlvM90f4a7SFGMTprTKYroT4j5kZFbI0/eQZX619DPn:WYQ0wAJuGNI1v6uan3pw2M90f4a7SFGi
TLSH
T1D35296F83EADA022DB253F30D6D81D06737151B44A231FE312E4C4BCB97A782C16E256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 9a531d59574ffec8f111c894683f08988ce561f01c1245c71cbc557d4092e6ee
MD5 b7183e60ca01032aa1c5493d1b3c8e94
SHA1 deacc095e3836d4eecc0c67c9bea5cf753f5d243
SHA512 c6916ebabf314f95e1f9bf1fe5ee3b3f0ea0d85d003b9ed47252c4ba14553adbf026be28bef60994ea5c796f2550e9a1fcb54e8eb54c4616ec5c61a493603e68
SSDEEP 384:GGdGAJuGNLVv6uan1sp/YlvX80f4a7dFGIrTKYr6T4j5/ZFbi0/eQZX6CGP+vHu0:GGdGAJuGNLVv6uanOp/2X80f4a7dFGIF
TLSH
T1DC52B7F83EADA022DB253B30D6D91D06737551F84A130FE312E8C8BCB976792C16E256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593d9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593d9c.TMP
Size 3KB
SHA256 4aa2c83964fcebf3d292aef6f116dd731619f43bc45c9e956820c566cd4373f8
MD5 23fc8e5a9a1ade2f0a3971826da5bfb6
SHA1 48b7938115177b42f6e409257c72082cd6fa5e69
SHA512 f5d7f9e72408aab981ac2b0fbce826c61435a9ab25b417dd539b20ee920fac515c759ef19f9213ddab7548a4cc75b0e22812ee4fa2158765b1f35656727b9a1a
TLSH
T1AA6181091A4E14B5F7611B31E8D10600F9B042B90EB72ED336F8D97EFA2EF23802555A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 47KB
SHA256 80628989d4be0b0fe95a44c0bbb89c3a7240d68c5fc8605ec06940bab73fc326
MD5 eacbe51efab9811d3b3affa34d195ba2
SHA1 0248fdc0e9d08731ca217cb212759e2c0c36c2d2
SHA512 8dd799632270709cd0aabab55ed1bdfc18c0b66086e4bb055298d434a92de2306f858b3238df7d3248e38159c279f2fd293b712ec9d261bf02ed8daf3ffd94d3
SSDEEP 768:vKD4gNSYjkgQQ79FnHsSop64A0k+ALWeQk:4QqjhB
TLSH
T11F2369B7C7F4666DCD2261F46A663E1FCD6E091497187CAF89D8AF0693E1430E201B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 ae6b35430df41d9a4c6579e39c260aba9ec35adbf5e5e9d761d493175df3132a
MD5 021374946055abd154c648eb8b8206fb
SHA1 e775371300a29bf08cf515adefe043e5e17cdeb1
SHA512 03aa89012d3a784665bb4f7b0771bbc8b485a24dce0f1f8ba8e3d2dd6369c6b8155b49321e9712d1baeca3e47a113007140864d39850037d02149b610c32563e
SSDEEP 384:sxZEpn1/fuFBsm1fy/f/NsQHKE4AyGFtZKLNNY2qHb55rnZvky/wCMAR7rNFJ4:sMZ1/fuFWm1fy/f/RqE4A+LNNY2qHb5C
TLSH
T1E092E852692449BBCDCBC608BD267F27D7F80462DE545E4CE9FCCA1C04AA6ED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 1b87487c5fc9c1fabf7b89f647e4b6def983855e8f8892b4c91c1686b8f42e70
MD5 dfb4d2303db2ef7a7fbf241be0753b6d
SHA1 46acb1dd3de5da6aedfbf77030239a47cf65be47
SHA512 8ec01a75480927290b1f662b1304d23a6358f641e149c3e359225fc9af8215d37b55f52efcb438f373f72b2e1a7f4a28a2c45578ece277b334b31092e3374215
SSDEEP 384:sxZEpn1/fuFBqflm4fy/f/NsfxHpgEV6YOAFLgMLNHivBhHbnH5EfcBhvKOky/w6:sMZ1/fuFIflm4fy/f/UxJgEV6nwLNHi1
TLSH
T15AA2E75265204977CDDBC619BD267F27E7F84462CE905E4CA9FCCA1C04EA6ED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2d259bd427c36737a4503ec7bdff60c3af7b0b9b9c09c11c3f4f3547fcb1f0d9
MD5 4350d7565a08632a3a143e5caaee0e7b
SHA1 3e618c28376cbc4c45d759de4f6d627d9ac30500
SHA512 7b6ef67710385dc111b597b783864ce0165ad77f70b02a4e1d685535c3a0dfd2797226d766b3fe2a53fbc44f88725f6369e05cce9a3f90002cc0b0002f472c0c
SSDEEP 768:+1fgs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNfxrocz:mYs6pD1WvxzWju1jahILIsNycz
TLSH
T16FD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3f3a3216-8741-41ca-9b7f-b3ef3551b1aa\index-dir\the-real-index
Size 72B
SHA256 9c0791c9e269173d89f948c5c041a507776ce83c185238550a388edff1ab1f50
MD5 9804eb0ecf8fc850f2d9566312d71993
SHA1 e59ee981363ccf5b5f5b93b0d52c787285c59828
SHA512 5dd3470a4ca38419ea703a509595aad31b741e3aedd908b85409b94bc076f3cc14babd479d731d1f0be63556e07abd87a78b8942ff41dfcbdd1823197fe564ff
TLSH
T102A002A16144344ED01923F8514301913615ADBA8205834F9295B664C964382A243103
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a09b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3f3a3216-8741-41ca-9b7f-b3ef3551b1aa\index-dir\the-real-index~RFe5a09b6.TMP
Size 48B
SHA256 a69ca5eea6a4744478aba6d92cab62883c49e3ef533818546f7c82d67fd3b357
MD5 cfff2e543d4a2184a874391d91864d4d
SHA1 82bf2008422fb5dc6830901f98bf571ec546468e
SHA512 a797064bc7a1b899dc55909ff727e5ccfbc5c1acdb4f2dd0de62244634758c564b9be685de1f0ccba99f545921dd724e9ffa1280c1a2fdc5c39fce45086cbf15
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\70599668-79a8-4baa-bc5b-42404e70b9c9\index-dir\the-real-index
Size 72B
SHA256 16f342c13cd7eb01bb8b242b175345f8fd7ca38fda5057bf518bfb29a1e1b3f5
MD5 281640895d369ce6a21f81fae4eb4280
SHA1 6a7134efbbefd53c7cc7c26d0061592dd911bff3
SHA512 6e0f795bf2fdd9b2cc7695366ce580c92508555c0d333774b41449badd4798f5c800c587c5dd28656dc37b3c6fd65d7163c53ea68d45c6528482a5607f8b2f76
TLSH
T11AA002B31154008AC04107F5A14645982326DC6D154143454094986998521595D75455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 27e540a8eafab714e768dc01bc45641b1103442566e1fcadb39e98b8412afca0
MD5 a7090ebf0dff2dc591ac9827d8df47a4
SHA1 d2a848bf5650e7026e7c29a6a59cca79a3d2106c
SHA512 53394690d9bd2b1189fc992777e0be2896a549bb78a42d4bec909a56b006a0f3cc08e617148c20cb44a49bcfd04e6bb06ebe86e157f1c7c69a11a87b3dd1456f
TLSH
T18941C88C0C528B5FD8A841B31872A4943770BCCD4A555653AC7C2135BD0776D2A5B3EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 06c415660752083fa25efa9f4d75356830b0f0e6958d6b0563c3732e3e8f0ecb
MD5 fc726c20c7c4fae2d41199e306d6fbe6
SHA1 0de197dbe1ca8ff8e43af9ce54c75343026c1b52
SHA512 0ef5584885b5a1e23cc4e7705e2a128f738ee71852fd789514da055b4296aa79a69acf4f32bfb80cc18de5ecd74a01a7461f18b543002b360527d07e7e803ba7
TLSH
T13651E75D4C877F4BCD6C427324B20848277974DC2A489E2BA4FCA13C68C373828B939C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585f13.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe585f13.TMP
Size 2KB
SHA256 e98f2ee3623d1462b14a572f67cd84f9c74fa428bb14d4edcc7e8445289b1213
MD5 47681886d4b73752ae227c986dbdc30d
SHA1 d5e1213d0d5121cf7cd1294025334624d70ee4be
SHA512 a4642a9a14cd606325412d2937331acef27efb6a0492f4a26c95c528af91af2b458ccd4e1e7702c8ba6cc98ef29604262a50eeb519be1f3228e8290ccffb5466
TLSH
T16B41CC594E818A2EE89440770DE274F47335580087157B4778FC9536AC927AD2E491D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 9e2d74b40fb2421d1e2ba4163a16df4fb4bdfd11fa1de9285f2bda826c67bb5d
MD5 6c4bd629a43f09ea90d94139afe2a919
SHA1 826a3e09f485bd1966b1223a5b036cf10f069af7
SHA512 86307ff48ebb05a4282a494735ff9f391ca65146cbdeebe0b8cf3f36d21e9f18bf4b1172aa4ee693281372be53c1143b7976883b3e801f2766e84fb06fd80933
TLSH
T178A002108BC00465C01362F2176303451340DCA55240234740A1404DEE509488D4505C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 b76b0a65c0a7b7f076ba14ed81fa5359ca33225e2034525b3b06ff00025a8f2a
MD5 2bcc0b7596200c9dea4cd2a3341af6ed
SHA1 5eef69bb551a44b6043608df7e5f9ff923f635dd
SHA512 a23724cc52ef3db5360d8c3c84cae1f4c0d3d777bc072e21094c39b4843f9b1de7f3ab6c35d41d7f251daca0b62ad3d4f2181b5a2d895968eaf1a988fe7f5afb
TLSH
T1CDA0022452C41107D26253B026D70265A2504A90A711130641D14A5CCD94576458308C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 c392d08626465646385cbf0f9fda64e8eb76f69e0119e0e203866b149844bdf8
MD5 0a1fbeeee4d72ca75abe1c16f281bb35
SHA1 c53862debee00935d12b32de6ef913cfbb639eb6
SHA512 bc1a91b1dd079f7026e7d3e9657e238ed4d4b32d5bf9335e09deb25df108a5cf8d6566cb7647482074edf7a4ad03832de1cdefdade7c99f45fc3044f6c6bc1a3
TLSH
T1A3F0277B6FF32824FDABA3D3683091B105407C188805FC0F546BB583D0B1316391DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 a8bf2ff1624df8837124ebfd74a8f8a81fb9e383c385960b0f54304dcca248e6
MD5 fdf7e282dc5a2788df910fa45a7b0f9d
SHA1 d777df218ded01e65d1de1f3dce1d549164bb5a6
SHA512 ed61bf6a7fb11f4de40b6cf5e5843aef3630b58bded26e36fb0225a2984e66bbc70bef867414ff5f7ed38ed80b47e3c88bb681663f0f932930ac882ad05a982a
TLSH
T100F05C7B6FF32824FCABE3D32830957101413C1C8814FC4F586BA58780B13153849C71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 af928797ff9672ae93aea09c3c6b9b8bacffbe970f46f0224648384c5cca8981
MD5 4dfc80da857adcec0f76c84d9317b5e4
SHA1 b73d7cb6193d234c54c174165b167c07d8de5e5c
SHA512 8e718fe0b29a444c83cb3d398020f5e093ac0cacbbf3977ebed3994f32aeac6b6686bb7e628d1c9956016269d0f89b5284362d0c276892980d1899dca5ea7915
TLSH
T1DEE0D8BB6EB76820ED6BE3E7247094750141381C8905BC4F586A96C350B13557856C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 de0e4474a0397f2b7783718ee3983ae880e5bc43400feff79587d8c8cbcffab8
MD5 144548cc4d9a90668f6843b8c55c8901
SHA1 ff13d9b922d0b5c460505b72080237247ce0fa5b
SHA512 c1533ec13ce0d58519c51aae16893cdd1d5d87c953e3557d4cb3d43e31b46eee6ab9964f3e12d97e6897ee60cac7e3de0cbf63debf4ae4c6516fa166fe42919e
TLSH
T111A002F1A15E0995F0041370B34105967220C8200605621353A4206AA8DA287A112006
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b467.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b467.TMP
Size 48B
SHA256 423bc2ff0697fcd6373d8e6658ebcab4b0e0285be150e2b96c801b32a79d9acf
MD5 9d2c24d8de74467ea75c8aa0902ee9ef
SHA1 313449371e3132c41d626a5daa153fa7e947d7fd
SHA512 5d2da23744e55ac79c74037055705bf4ae705ee5030c3386e01838610cc643d97e270fc9539dc3c4d7924252577f46e90d1dcc352f754492019ac465284b8bc8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 7e8e8bdc9b508a8b48775ba28086129ade6c88984a49d403cdfd7cf7f764bc81
MD5 223dbe853abe9d9b0b460c1e98fc0070
SHA1 f33aa01cf71df5a9cff09f425b9344bd140e7740
SHA512 b099a18f1e7feeece493087b4f842835b2ca20aa015d29119636c232ae6d0371922fc4d6fe9b641bbdbf9e2ee911c57ae8b9df919f6afca6476a4f174791485b
TLSH
T1A0B012813907EC11CC091AB455C2D6543030BC1002060A42A1F0CC96504208092000C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 94b20e857c22dc7d715044be565534241604734393f27c50094c156f26a5e62c
MD5 82f4391a6aeb09c45ff890e5309f4d7d
SHA1 30f75ff3b9bac09b1dfb1f0c094b69c2fcc2433e
SHA512 007841f3bafb3e6e61a3e4879e8850b3aae00d812ec99c4c453d487691c28c14f1d90a5840ce7ab4c19c83f2a835d9b13b59560aef26d2ebb23e84dc3b3d9f42
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFzIVKwEfyI/Kva4bytLIxK8IM/:KUAAKteP+zWKwEfysKva+OLeK8Ig
TLSH
T114B1340271B713123D7E2908A299976A5F8276633814F42B77AD40B25EA7F340DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa392e5b-d21b-43c4-83ef-e6636cfa90f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aa392e5b-d21b-43c4-83ef-e6636cfa90f0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ffc6dfcac964fea3abca0245313a4c52cc1f2900f07bd00eca158877a93ee111
MD5 44352508fbc3cb5c5ce9130f7b478f24
SHA1 c7b26d7c7bf0dd39968f64865fe5b0bf5c24ee9c
SHA512 33050dfef53e65c3274c71c165474e6525649f308c8b58a00d699f49d7c899b83a235337fdf28eb83022e7903158de27c12aa319cba51aad4f2519f39ddf1a21
SSDEEP 768:anrjzFnj+9MMU5Ewg6rFsXZSUL/WXtiO2cR/mn12bfZ+lq4:x96H0yZC
TLSH
T1AAC218F258DB4936D9AE8747B77E2E078EBCC063F5852A50B3984A0CCD961BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fdeeea9123ad9a23ad4d8338a7f522954b29cac6df027798c1d0bbbde95a7884
MD5 870afb58b1cdf6ef32c6d4b705d7deb5
SHA1 db130a4fd5183459de6878ffa90e5337ab7cd9f3
SHA512 6ece6aa9f173846eb50a6f449e984614e9fea4b1ebcf20420607c8be01cd98b91d12c732dd83158d4f382320de853560b39fae579c6fd311cd0b12168cfe997f
SSDEEP 384:in9tNn/s3n9SpssNGMMrOTq6SaXqqTL/WXka9sO7SBKR/mn15wbAjEO8+lq4:in9j+90s5NrFsXVTL/WXtiO2gR/mn124
TLSH
T14E927C36686C1D375DE39488FA87221B9FB98077D6C92F5084DC9F4D02DB69C131BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43330406b855cb1f9f554864fc9892ee926784f73a5019183876781c6efb76f3
MD5 4c1b638cb2504c218036eb0fc6176a3e
SHA1 b67d61d215da4367429b91f2183e2457a5dd9bfc
SHA512 32b5f658fac0a4b59464c27d9b6ec38b76effe956e1491e1fb47df0760496388492b7d9c6be4a84c473e5bf1a65f417ab475caeea3b8881d6f870017ffecc9b7
SSDEEP 192:qONp6O7+3hQmiUyEBETGttb0RO2osgGRjfU6:qONp6152TGt9sO7CRDU6
TLSH
T1B902F93968686CB78EF2AD45FA8727279FA5113BE9962F40D5E81F0C00D7A5C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 11ac1af9747a44f673eb3be914558830258fa4cacdc4f8c2a09618b870a0f8d8
MD5 c25eeb2d7a630b9be6a67b7f8e0575b9
SHA1 0dbfefb3d61478a66bb763512b125a7c7d665184
SHA512 146158f280dc92a4e5f6a0add46498d987669f3693637b1a077431c271bc18ec5ab689b2fbb1b5a6347f721d686a7aa71483f5c7d494830ddaab4c3735907400
SSDEEP 384:YWtNn/s3n9SfsNGM5rOTq6SaXzqpL/WXJ2a9sO7SBQR/mn15wbAjEO8+lq4:YWj+9U52rFsXWpL/WXJ3iO2CR/mn12bs
TLSH
T139927D36686C1D335EE39488FA47220B9FB98077D6C52E50C4DC9F4D02DB69C131AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82545a742b036da296655c89a6dc86e1b57b12b60c0d147df94aa051ec79f1c2
MD5 3bb8b197c8b347cdf0bb1e5c61efec51
SHA1 c1a3cbc15a9f94f392ac8a2d0dc032aed0b6e14f
SHA512 46f933df309b61b5f315e414a9ea093bb2e5614a4c7cc64135b31d4f45b050d2a29deab350e4cb67427e48863aa7ad708f6b7d881d97ec4049ca2258a5e8048f
SSDEEP 192:WiON6p6O7+33ZQmiUyE2ETWYttb0RO2oSBEcNRkq3qAU6:WiON6p6l35NTWYt9sO7SBtR/U6
TLSH
T1D2121936786C9C779EE2A185F98732179E694137EA466F80D5DC2E0C01EF96C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e03dc75c44ccd7549c754c0208c1b9e1aa3ce472e150d594d5c897fa9374d07b
MD5 6293ba26a29301c51a94997719d44dfb
SHA1 42a07b532c0494bbdda1bce5cc9a9a52e21b8db3
SHA512 6db1c28abe824eed6e87c7bcb9602e6b6362b1f07f8fd64573b66a5d85e7cb9b16e780bd2bad7d8521eff165b570899a64649028d27cf934e513c92eb6ec321e
SSDEEP 384:anrjoiFKtNn/s3n9S3Q9ssNGE8TUNTUlIlMrOTq6SaXqqOL/WXka9sO7SBMR/mnh:anrjzFKj+9MMs5Ewg6rFsXVOL/WXtiOC
TLSH
T195A26C375C588D3B9EF39A84FA4A321BDEB540B3D5852E90D2DC9E4D02DB69C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f234aa5afcd4d4aacb8090b5f4b11c75e067cdd44c4a0bd6caa07880ddef0da6
MD5 ba116ef9feb2d4d130d173b95a8b2aa4
SHA1 df4695d80b3d4181c04a31773192f6051228e913
SHA512 a6ba3933cdd38fd1ee351efd283be24902fb503411564691ad61f1d61f6d7bf1ef27df728748ebbe36defb507bd6b2fef5ffad55191ef3f8b666fa2d926baaaf
SSDEEP 384:inWtNn/s3n9SpBsNGMwrOTq6SaXDqEL/WXka9sO7SBQR/mn15wbAjEO8+lq4:inWj+90B5BrFsXmEL/WXtiO2CR/mn124
TLSH
T182927D36682C1D375EE39489FA87221B9FB98077D6C92F5084DC9F4D02DB69C131BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 920f8a5e1adc072ed17d523ab4321862b32d20465023628693880635f9f502ed
MD5 0718f43c94f9443e45272fd2079204c0
SHA1 b9292c504175f228d6f426b8981a8873ab83c40b
SHA512 2503a0240591880b61493e863c4b8723a64008cc04d1ddada9e0ba415f365eff1193ea81adec64129f464ab1f9a9d0da3b9787de5608b22081d79b84bee1faef
TLSH
T1ADE00147975500EDC036033200031F307FE76031017416066F74026D5D633443F34B84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b99e5bf2cf9efd2b342bd3d1bf2e1b15214c7234752095dcd27930a48afb88e7
MD5 abf1d549c0efaa85430d3c824962cd40
SHA1 5227cf7e7875266e9bb3ba1fa16aaba87675e87c
SHA512 54761264485e0d20cfb2f96307d5cd30a5858a56055be14faf4c6adfb24917f805b8fcc0095b2f026a00aef055927cd7102c1fd0371517985db7015621e50f86
TLSH
T1C9E00247535400FCC035033100031E301FE75030007416056F54015C5C533043F34F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 28459c8044fb14385bfe0adecf90644fde7ee6775bcadb355453bcdf4d27cf93
MD5 aa08ac03c8dd324d8f9bb9cb582c2619
SHA1 c6c31057173d6f524cfca3deda3d5f0cb133d218
SHA512 831a4e6c8d4c12d53e85d9a9e67d85b1b1379310d8d38dd5277bb94853c258c18dfe0ed7fa627b7fd458c3fa0ee2cad93d7d4971b965797dd228e11c3e95589d
TLSH
T109E00247935400FDC035033100431F302FF75030017516056F64016C6C633043F34F84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58a042.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a042.TMP
Size 392B
SHA256 c5523876c91dec0fd22d251414754f3f0ab6d0933f3d69f6c50d99c83b6fe62e
MD5 4de84fd8596af3bf451cc4693c8dc9b7
SHA1 71a327bda9ac0c5faba8820f0b10b1fa76b41b2a
SHA512 7094acc5d40852e8fa94755ae95b4aa69d3f3f97ead81153e73324ed419008913ce14088653d8a641b1d18aa6669d3a77fafc7cbbda3155ad148359829ba0a7b
MD5 SHA1 SHA512

Submit Download

3ecf7316-f1e8-41ca-9222-a28b1dd83f60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3ecf7316-f1e8-41ca-9222-a28b1dd83f60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 343d59e28648ac4a5974e6090f5557b30070d5d310edd9f08f15e039ce1bae36
MD5 0bb5336d79f97e21e406f3f16fbc624b
SHA1 b70cc490c8d42de832e7585202703f4e2cbd2ae1
SHA512 4d9af5c9e722f204db6d2ba44cd86cd99ccbe60c8468eae878c3b0e7496b54e247e861a465e50fdfd90441f41ed54244daac7f3014fffce26b41ae47a2acad7b
TLSH
T1D2411658A6ED1148B3B36E1AABF6A86D487EBC372F0B945D00110E4F4A62A40CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download

Xworm V5.6.exe

Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa5636.46488.rartemp\XWorm V5.6\Xworm V5.6.exe
Size 14.9MB
SHA256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
MD5 56ccb739926a725e78a7acf9af52c4bb
SHA1 5b01b90137871c3c8f0d04f510c4d56b23932cbc
SHA512 2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
SSDEEP 196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
TLSH
T10EF69D107BD68006E47269B00A946AE199BEBEAF2B15D8AD30C4335C17F64CCF953BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWorm-RAT-every-version-cracked-by-R2oy-main.zip

Path C:\Users\Admin\Downloads\XWorm-RAT-every-version-cracked-by-R2oy-main.zip
Size 43.0MB
SHA256 4fce6a058ab1c3219eba936759c4cad530f38065b138c0d07bc75cf997fd5d1a
MD5 28cb8d2ce78066f7f728d5f9a4d11554
SHA1 bdd7214d5b5ff6d8e46e11619bb5bd6b49604f0a
SHA512 63e96f8c4aa83f759ca053ce16f4a1364aa71c1f94b3448c335487c07fdcd220c418f30879eeb41f5a1f741c05f4de88902cf4975fe56314500a572c834b4689
SSDEEP 786432:Vq3hyamVV8fOJxqIKKBfUTbBBemByfVkOQ5wHTrZ40LcI3kB+sO8pLqUMzivou0v:E3hyamVNqxEUTbfem7OQGHTN4Dp0sOQc
TLSH
T117A733C2B560778C0855F89D63C7CAD8DF492AD328D9593C6AA083817E1DE81B3ECB5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-713.exe.crdownload

Path C:\Users\Admin\Downloads\winrar-x64-713.exe.crdownload
Size 3.6MB
SHA256 dbc951b4ab01646888b2a91da73a94dd920054c2f27c8cfeacae3eba298e71b0
MD5 53ef4972d65304468d2519aa692001c8
SHA1 095036f9669230cb69b42eb5e6d91fdbe46ab61e
SHA512 3be4a4f1715a06863d552d726549268ae38327023d92b43767c3f71bf34a8f1f46d3d2788218831716016438bedac057068dedf4698cfe6d7ad9024bba49c46a
SSDEEP 98304:cRZBAYtCkpjsMig0xgsXzQZ5exHkZfqXdl/X+S2H:6RM6S3LXzWexPX/X+R
TLSH
T17C06231DE79418F9E037D238CD934506EAB2BC9D9B71C68F23A515A92F237A09E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/7752-2272-0x000001D949100000-0x000001D9492F4000-memory.dmp

Download

memory/7752-2271-0x000001D92BF60000-0x000001D92CE48000-memory.dmp

Download