hxxps://mirror[.]anadius[.]cc/sims-4-updater

Analysis

user interaction
yes
max time kernel
107s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mirror.anadius.cc/sims-4-updater
Sample261024-xb6ffabx21

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
181	4764	msedge.exe

Loads dropped DLL 36 IoCs

pid	Process
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe
6040	sims-4-updater-v2.6.6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4764	msedge.exe
1712	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	sims-4-updater-v2.6.6.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{CBE77CDC-A09F-4ACA-BF0B-E38B46D078DC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeDebugPrivilege	6040	sims-4-updater-v2.6.6.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6040	sims-4-updater-v2.6.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3772	5012	msedge.exe	86
PID 5012 wrote to memory of 3632	5012	msedge.exe	87
PID 5012 wrote to memory of 4764	5012	msedge.exe	88
PID 5012 wrote to memory of 3632	5012	msedge.exe	87
PID 5012 wrote to memory of 3632	5012	msedge.exe	87
PID 5012 wrote to memory of 4684	5012	msedge.exe	89
PID 5012 wrote to memory of 4684	5012	msedge.exe	89
PID 5012 wrote to memory of 4968	5012	msedge.exe	91
PID 5012 wrote to memory of 2432	5012	msedge.exe	92
PID 5012 wrote to memory of 4968	5012	msedge.exe	91
PID 5012 wrote to memory of 4968	5012	msedge.exe	91
PID 5012 wrote to memory of 2432	5012	msedge.exe	92
PID 5012 wrote to memory of 2432	5012	msedge.exe	92
PID 5012 wrote to memory of 3288	5012	msedge.exe	93
PID 5012 wrote to memory of 1040	5012	msedge.exe	94
PID 5012 wrote to memory of 3288	5012	msedge.exe	93
PID 5012 wrote to memory of 3288	5012	msedge.exe	93
PID 5012 wrote to memory of 1040	5012	msedge.exe	94
PID 5012 wrote to memory of 1040	5012	msedge.exe	94
PID 1968 wrote to memory of 2120	1968	chrome.exe	97
PID 1968 wrote to memory of 2100	1968	chrome.exe	101
PID 1968 wrote to memory of 2100	1968	chrome.exe	101
PID 1968 wrote to memory of 1712	1968	chrome.exe	102
PID 1968 wrote to memory of 1728	1968	chrome.exe	103
PID 1968 wrote to memory of 1728	1968	chrome.exe	103
PID 1968 wrote to memory of 3840	1968	chrome.exe	105
PID 1968 wrote to memory of 2736	1968	chrome.exe	106
PID 1968 wrote to memory of 3840	1968	chrome.exe	105
PID 1968 wrote to memory of 2736	1968	chrome.exe	106
PID 5012 wrote to memory of 4244	5012	msedge.exe	107
PID 5012 wrote to memory of 4376	5012	msedge.exe	108
PID 5012 wrote to memory of 4244	5012	msedge.exe	107
PID 5012 wrote to memory of 4376	5012	msedge.exe	108
PID 1968 wrote to memory of 1428	1968	chrome.exe	109
PID 1968 wrote to memory of 1428	1968	chrome.exe	109
PID 1968 wrote to memory of 956	1968	chrome.exe	110
PID 1968 wrote to memory of 956	1968	chrome.exe	110
PID 1968 wrote to memory of 5344	1968	chrome.exe	115
PID 1968 wrote to memory of 5444	1968	chrome.exe	116
PID 1968 wrote to memory of 5444	1968	chrome.exe	116
PID 5012 wrote to memory of 5636	5012	msedge.exe	119
PID 5012 wrote to memory of 6096	5012	msedge.exe	125
PID 5012 wrote to memory of 6096	5012	msedge.exe	125
PID 5012 wrote to memory of 6096	5012	msedge.exe	125
PID 5012 wrote to memory of 5076	5012	msedge.exe	126
PID 5012 wrote to memory of 5076	5012	msedge.exe	126
PID 5012 wrote to memory of 5076	5012	msedge.exe	126
PID 5012 wrote to memory of 5372	5012	msedge.exe	129
PID 5012 wrote to memory of 5372	5012	msedge.exe	129
PID 5012 wrote to memory of 5372	5012	msedge.exe	129
PID 5012 wrote to memory of 4268	5012	msedge.exe	130
PID 5012 wrote to memory of 4268	5012	msedge.exe	130
PID 5012 wrote to memory of 4520	5012	msedge.exe	131
PID 5012 wrote to memory of 4520	5012	msedge.exe	131
PID 5012 wrote to memory of 4520	5012	msedge.exe	131
PID 5012 wrote to memory of 1112	5012	msedge.exe	132
PID 5012 wrote to memory of 1112	5012	msedge.exe	132
PID 5012 wrote to memory of 1112	5012	msedge.exe	132
PID 5012 wrote to memory of 3836	5012	msedge.exe	133
PID 5012 wrote to memory of 3836	5012	msedge.exe	133
PID 5012 wrote to memory of 3768	5012	msedge.exe	134
PID 5012 wrote to memory of 3768	5012	msedge.exe	134
PID 5012 wrote to memory of 3768	5012	msedge.exe	134
PID 5012 wrote to memory of 5444	5012	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mirror.anadius.cc/sims-4-updater
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdb9fbc188,0x7ffdb9fbc194,0x7ffdb9fbc1a0
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2029491912973561730,14802244764439157592,262144 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,12200926881759911073,17827330074567173108,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,13651122808250443141,2950293254876853460,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,8509974795979749348,3890623354727595091,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16571477977226076939,11022888062243430886,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12252161004764951419,494294923879793011,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3437505026239038091,15585782754862457761,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,662826109918599381,17599097696576297289,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2614903027395764149,2815033455367623595,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,17195325724721791651,8450686881074589919,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,17195325724721791651,8450686881074589919,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6540,i,3745741563552041307,12399550809317038300,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6200,i,2564537631334135407,334289034889806484,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4280,i,3894083194937869118,11641537892360626871,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,8565292498809537412,11989164303834330211,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6164,i,9372185533219971565,13834303129303903166,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6956,i,10434287324421749328,11679702134063745694,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,1039166582981142802,10803627948638025200,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6924,i,12263986586669357742,10210004555192803415,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,11894769647284510752,7641340639571340967,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,1461626633549283495,6570160115434473390,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,9191576822355539162,5884403137986385094,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,3867458551668102070,4597604134478551442,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,15451100484664592666,16553494536116728200,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3048,i,11318855764966946709,559943806532674901,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5668,i,7705177358393897396,13349018865123809624,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4436,i,1716011647081627260,10429622674213200156,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,1281000709104413967,12929956404144034527,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,435914552829610044,14588018848670773044,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7220,i,6344784252299928645,7439469660231284992,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7628,i,760274297767975719,1183194851946625978,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4244,i,1012190471516001803,9045260101120801582,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7616,i,16203792359563440738,11904752410463577958,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6864,i,10900250962187051532,14943364839131341535,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6164,i,6428049110465321784,8832672150942336895,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7828,i,4874491138377046569,1435794277773430648,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7980,i,11025499361768982375,3438916216737685669,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7644,i,1461040831501152530,11611976210423244435,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8124,i,6251907829351010301,17911698300056695239,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8480,i,10314507604098469822,592304043994626883,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8668,i,15180734158471234583,4118371449009893961,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8820,i,16577807223024817313,9656154537202221767,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,13980925618139754595,4428378202541067804,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8216,i,12533907409097486031,15454335895327031964,2097152 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8804,i,5324012890295694651,9272615445455901443,524288 --field-trial-handle=2036,i,2677499753968076851,16835133889072083271,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:8
  2⤵
  PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdab42c728,0x7ffdab42c734,0x7ffdab42c740
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6291490831201451083,2871723306879668806,262144 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1596,i,7705271591117384763,15825387401258075167,524288 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1592 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2404,i,16743019339007435594,17193965933173496758,524288 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,5432733329050583527,1195657529353096559,2097152 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,837652250106911010,4822091315947137286,2097152 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4540,i,5738317163964707709,13011379665206943157,524288 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,16636502459720592794,8312290526766772400,2097152 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4584,i,12547291213138701370,13492368323444807007,524288 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5456,i,12570307359058970375,1834904620028034638,524288 --field-trial-handle=1984,i,5276612834067394363,4931676765506532363,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1620

C:\Users\Admin\Downloads\sims-4-updater-v2.6.6(2)\sims-4-updater-v2.6.6.exe
"C:\Users\Admin\Downloads\sims-4-updater-v2.6.6(2)\sims-4-updater-v2.6.6.exe"
1⤵
PID:3748
- C:\Users\Admin\Downloads\sims-4-updater-v2.6.6(2)\sims-4-updater-v2.6.6.exe
  "C:\Users\Admin\Downloads\sims-4-updater-v2.6.6(2)\sims-4-updater-v2.6.6.exe"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6040
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\sims-4-updater-v2.6.6(2)\updater_readme.txt
    3⤵
    PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5cb4d5d4-7054-4c03-af2f-a6bb7151e88b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5cb4d5d4-7054-4c03-af2f-a6bb7151e88b.tmp
Size 269KB
SHA256 f140a3c32f24c5db057baa4f86748318967a19065623b4ca78b6c0cd0be72407
MD5 272b99332f074b6c6983aeeabf1fab6c
SHA1 b5f12510a8bbbd913ae93c3a660bc83dcdb97d8c
SHA512 9f1edef5345c4a4903f7e5f647a56f9074d591d8a43acedb386c4a23b1182eb31193c8526a99810277ef893fd12cb7ba4c99fcdc81ab459b99f6014be762f976
SSDEEP 6144:/V7HCsUfw5u7eC94LUX4rY7Q/CA+hFD+7t56OD9ZfSApprz:/Vus2w5Ee5HraAyFSXD9ZfS4V
TLSH
T1034423F1EF6A186B5EFC4606B21773084F7ADDE599CC2549804B2F4B309EB890667623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
MD5 6ac2bdb5618eb33217283a8c2a2bbea7
SHA1 929bbd0ea4faacadcd10729d56f75f85718fe818
SHA512 210db67eaa7e247fa4c61bc2e2b4275f8573062e567be16ef70acddac71222e128e021da8a6e8867a5b5f1507c9fa736ffd85aef609528eb4c496e58ccdf5830
MD5 SHA1 SHA512

Submit Download

161b2fd1-999e-440d-97a4-292a36938859.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\161b2fd1-999e-440d-97a4-292a36938859.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

98064504-8ea4-4109-86de-cefa636eb974.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\98064504-8ea4-4109-86de-cefa636eb974.tmp
Size 414B
SHA256 3fe4b2ea97ed8f3747601fa86983dd5703cf306e445ffc2248a9f86324ff2bff
MD5 8066a30f1a674d06161c986bcded9c59
SHA1 c4b9809d3f6cf61d339f81326db2d6e84b3a2a50
SHA512 fe565ad47aa699ffa97acba1e6dd19814e97301c6bd7ad84e9db6fdea5f712960b4423895d8bf665d33c820c6d1e45a9176e78c570ee30be94785a4bfc1cbdb1
TLSH
T161E022B9CD39EC373CFC5B5810544B4AEA80171726828A5F373C820D8FB52BB898AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 74af67dfe9d5de18ca46e9ad91d603b68edca979ddf9422b31205d3dade5c390
MD5 25eca1cacaf702c0fc249889eeb8d10a
SHA1 714a8fd2711e7f531ed440a3de8323496ca411a2
SHA512 b492891752b9202402d9d11afb38b3e32c86e7a6618d276e16ac34a521cc2d824bf6c0599edfdb281c5b885284a531369debf7712572e8cbd3a8c1bacc8a3255
TLSH
T10CF050A7E27E7467407A45A72D00B4461AB57C3401429CE4DE9B412CF0D50A30B93143
MD5 SHA1 SHA512 TLSH

Submit Download

e4a4f84a-4bb6-4c76-8354-74473ae544c0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e4a4f84a-4bb6-4c76-8354-74473ae544c0.tmp
Size 1KB
SHA256 0aee20ca149a6620a13bfb3e1c638ed7bbf76247bc7818f985dd1c9d343a9ffc
MD5 99454d43dd97b46253981b37be4b3f02
SHA1 0d06faee10c492eb6ff411ce4ece31f6b95cde3d
SHA512 d1d9693de6ca42283d097c3794d2a37b26b29c6258e299a9a2eb77c29afb2f4ff6e0d54bf1ade200cac871e3d1b05475713b5b7134f9a701cb3b942635991aa6
TLSH
T102419BF7C3E49A7D890556F4AB157F1FDE790A24132C3C66C8D4AE1B53E29B2D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

a5e16225-8f99-47f4-887a-a6b4082d1aba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a5e16225-8f99-47f4-887a-a6b4082d1aba.tmp
Size 11KB
SHA256 281b9c0b28794e45b2cae1f4f87303000f8ba01f597bff5335bc6298359fc3e5
MD5 145b8bcff3212ed8bf75bb511c23d4e7
SHA1 b9dc7d543504b1f63ed98bc73fb77b5368f36efc
SHA512 f0b4d038f231cd97ec2c2489ea5817798a789e1d21222a20f234e884dda748dded5230dc40fcc07775de44d1ea4a2f2c8173af4924b6dc84006c2fbb08fe7438
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9iVS27SS0S:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLt
TLSH
T11B32B827A48D9A3F0FD8D51DCC12AF8BADF5025263780D2496FB9D14039A7CA214E5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcd4d354-4b3d-42b2-aa2e-f682349b2951.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fcd4d354-4b3d-42b2-aa2e-f682349b2951.tmp
Size 10KB
SHA256 a0b00e9555ed0d1e366015bc4553f707c82c73072421b2c00339badaf112f4c0
MD5 308f6ce7647924fddd7e416538e27dbf
SHA1 99273a45fdbd082932f154263119fdf6027d53c1
SHA512 bc9128ca618618317eabb13211d1b41902cde41c42554ad1a093e396d35daba13054bb5a26b65919ff9cf81693f0976a327f07172279a6f08f15fa4e9bc57dc4
SSDEEP 192:8Rl3CDQEmv71vAPRp2Z9IHsb+WNn9i0N4rPyIsnAUge:8RNCkES56X62w00yfe
TLSH
T1E022811DBD14763B9CCBD22AFA21BB57D3F5102221952E84E6FC893C25EB9CC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5ebda83-9724-4350-9e88-fb4629182f31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c5ebda83-9724-4350-9e88-fb4629182f31.tmp
Size 130KB
SHA256 fa74b052b0577fa8318f7c67d49c491c7f27004ac3eaa1151597db0c081d912f
MD5 61b120fc934f2544705e1070d02b9ba8
SHA1 591e04cca1bbbb37b00a09f424ad53a0abcacd31
SHA512 e5142eda39e2bcabc5acaf49b59c692be50e23e846fc2eb8ef702cbb20acda8795f16671e97f44b33dd6b477dbe6ebad4653c611ef8388369d488ac34963c0ac
SSDEEP 3072:dqE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dqE+hFD+7t56OD9ZfSApprr
TLSH
T141D31232AA91D8BBC9FC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c1260ca-d4dd-4c3f-9fa9-8644cf48fef8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c1260ca-d4dd-4c3f-9fa9-8644cf48fef8.tmp
Size 18KB
SHA256 84b9ce7e9761e2fadbf1283326cd68c76e33632aba443c70b06f4874afb445fb
MD5 5c90c78fb95ce845e5708cc4fbbe3b45
SHA1 a44ab016eecd133039e2e7cfe5533b700435eae9
SHA512 c7d2fe28263a492cac1762d7317909b222f1aab3fb1fa85d5cb48dc7337aaf60a7cccce1dcb229f945a4866617b14bc224644f54b9ff88367023c7cae6820050
SSDEEP 384:gQkUSvGsNG84mbBc1IrluzIGmuYBHZir2IuumIIlf:IGtmbuyCpYB5ir5uumLF
TLSH
T1BB827D36ACB87C77DEA7A950F94A3A139E748157D2C46F94D6CC6B1C01CB29C230BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3dd3a48a-5622-49a5-bcd8-3da2404d79f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3dd3a48a-5622-49a5-bcd8-3da2404d79f8.tmp
Size 392B
SHA256 e132b675f728885e98dfa5415dc1739447691c24d6653b070322047c64ca6496
MD5 adb708f605964e159a7e8f220e899c94
SHA1 6ab955c9387346682cb7e86ea27da2da4a8bdddd
SHA512 f658cec82f32e331c0232121898028097d16030674d8efacc8972e2e3c5461d3d3b565766cf9ed081cd8293a7c174e3d2b54914160ea2272e72dd3600cdda438
TLSH
T14AE001129B0051BDD02C133564931F206EE394B414E506061B39056D1C363653EA0F81
MD5 SHA1 SHA512 TLSH

Submit Download

3f086eec-16b7-45fa-8e92-ee0bd14ca851.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f086eec-16b7-45fa-8e92-ee0bd14ca851.tmp
Size 8KB
SHA256 d1b83cb1f6da406f97c97c08fb4ce6645675c8648e61f9c2d46e3b5c3aed0768
MD5 e96145476f963fc5e1a80c576382028a
SHA1 97c177293939b3d69a815fbc32b228a42efdc3ec
SHA512 64697ad0aa752929f7e3d24cab6201d15bc193cd63e3b15a28ebdaaa32ea02491ca91d0b7ae862e32e5d5d2cea89e8a067511fdb14146ff1d09b781616dfaf5c
SSDEEP 96:3qONkgQsjpfe/tyng7X5ih/cIPURHl8h4otop5cYDmNBnP9ZvEI0IG2jbN09Pqs5:aONE6IE7QmiUy9mTPuIGmuY6/C7s8IU6
TLSH
T11802FA35AC78BCBBDEB3AD48F4877E27AEA5112BA5912F84D9D81A1D00D735C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43390527-4197-4e6e-b8ac-a145daae6f23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43390527-4197-4e6e-b8ac-a145daae6f23.tmp
Size 18KB
SHA256 ec71f7f1c191a035d2eacdc17b6f617cbeef6e9dc25b9df8cc156f724e18026f
MD5 f521da17ce1782c6754a1f02ed3145cf
SHA1 3decc4a8943a85c1ce026233e55b88c3fd0bf089
SHA512 e723a6499470741183ab626a576d52efffdf623d505084eccac0ca309e8076bc15c78cc48ee6822ca143e74b56002018ac8237571ea101a682865cb8c8c909dd
SSDEEP 384:DQkUSvGsNGx4mbBc1I9lizIGmuYBHZir2IuumIIlf:tG0mbu8WpYB5ir5uumLF
TLSH
T1B4826C36ACB87C77DEA7A950F94A39139E748157D2C86F94D6CC6B1C01CB29C230BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a455f64-b4ad-4fe6-b2aa-7207d3de5b0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a455f64-b4ad-4fe6-b2aa-7207d3de5b0c.tmp
Size 26KB
SHA256 132c992515862eeb009829b309a7d1b6c35dcd753171e794da6a98c5bdaa04ed
MD5 4a509679bdfbe355eeba79dcd0b4b07f
SHA1 d0b826e09591eef1ef8a82d813a689e5877bafb9
SHA512 6e138edf859dbe22ef006ea520dda11a7128639333b3044066e90be17132ad29d6bbc8bfcf70dfbbbc4e09e00fe93ce80ce7e8be1c167bd3154c64c0751838a7
SSDEEP 384:MiFdQkUSviRsNG8TUNTUlIlJ4mbBc1D9lMzIGmuYBHSir2IuumIIlf:3FHo/wgUmbufopYByir5uumLF
TLSH
T123C219F25CE75876DAAE9B43E77D2D038E7CC057B1849A50B388591CCC861BFD30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86788ca5ca7fef7f10083df937e9ae5d0b7ad97c73a11bd065eab327a3a3accc
MD5 3fb8eb7bfde3d8102a06490273bc620b
SHA1 41dee86f27971fd3f90e44b41ebb056a4b3c0b0d
SHA512 5261f86c70a6d0ae8cb560d97ec0ece97904ab587a39c6c3ec2a0151fe33d72b60b271fe8448855de37981e67315ea16bb3a85e3af9a86bfb740a64d972b5045
TLSH
T16AD080F07AA779B9D17E75750078D5C151489F53515406212A235C1C1D940C76965FDC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

04263222-2915-4df7-a37e-fbf4b3b0927d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04263222-2915-4df7-a37e-fbf4b3b0927d.tmp
Size 12KB
SHA256 19a7a3a469a142e117f285fa8d95dc39fd7f47db8a3eeddbcca590794df620d7
MD5 9994210065ee65eb81b509d478594f99
SHA1 e4d44b8b2822f9968eef47845159fae855a875ac
SHA512 82da9a89fc6ddf5dc74a206a5fb1764cda598fb2f8c7d26ca4373387de7b7dace02e21a5161fca8f64502838a335d6056af27ceab172e94b1e15001b49331ff3
SSDEEP 192:sxZSRsPt/fSsL5adIdpiTbas10kyTyyVHW6+WNtF/ARuzkrrhXYapHuHfIg5zSJ:sxZSyt/fSsN3NLHb/GRXQs
TLSH
T1AF42A653BD3459BB8CDAD259BA14FF12E2F9603251D11E88BAFCC91C14E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2414314e-d3e3-4758-ba0d-c3a90520daf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2414314e-d3e3-4758-ba0d-c3a90520daf2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b92fa31-2277-4c1f-85a2-c76787b36154.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b92fa31-2277-4c1f-85a2-c76787b36154.tmp
Size 9KB
SHA256 950154d9ae2fdcc64e5c398550fd2b42249aaaad5b206c71951dbab1fbaa9bd1
MD5 6e5670722e30310b74b5ef50c2740fd7
SHA1 f56a4ef5e538aad28381c96137a0c8e9afb0e911
SHA512 e6cafc2fed5b9c9ccf4fd63a0135cf15036b2dc0e19d656f370aad5ffcb9d9b281ebd7db89f2c8aa421752c6c1fe47f1dd6b559d11bd887ac0f23a68a6025b9d
SSDEEP 192:sxZSRsWt/fSsp5ddIdpYvHW6+WNkBG/YapI7HfIgrJ:sxZS5t/fSsr0eHbj/O9
TLSH
T18C2297527E28A97B8CC7E21DBA15BF13E6F91032A1D51E48E6FD961C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5255a7f6-007f-41d3-accf-f8dd5c94da2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5255a7f6-007f-41d3-accf-f8dd5c94da2b.tmp
Size 11KB
SHA256 aee9792fff4ee47fdbe11b111a4d9eb73cd6b21a6f0d77f24b77a25f190fb39d
MD5 6bbf293dfb8aa93b1d2b121be1f1650b
SHA1 2e2337d47aa82d27bd767db78c6528346083f745
SHA512 a901834335c76a08e4f3a1acb4293fc6364ac00c49aa70689cdab6056912da457a6808c4a39ca8ce04fd6d2b6dab540aa4b5afd7a7c358e7708cb7ba9ccd966f
SSDEEP 192:sxZSRsnt/fSsL5XdIdpXrFhZshKHW6+WNtzrhXYap1FHfIg5zSJ:sxZSct/fSsNuby8HbHXRs
TLSH
T19C32B752BE34697B8CDAD25DBA15BF13E6F9203291911E48EAFCC61C05E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89a8410b-faac-4a2d-bdba-bc6f071b9a97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89a8410b-faac-4a2d-bdba-bc6f071b9a97.tmp
Size 27KB
SHA256 fef1e848faa0d34ba15f114e93ec8ee9a78649905ba077cd47c6b7bebb5f63e8
MD5 eb42ab7cd2f3cf74f8577218a8dc136e
SHA1 3c22a6acb944130d85e5e1751d1e9d227524613d
SHA512 c62b3784ae8a78c6149b3d518f96f27161590783ad576215f14b38070a0d219ce27b1385a4855d010ed1a25e82adc6ea9e32541e5ffd9f1f6d7fcc7f19f3bca6
SSDEEP 768:ayWPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7pro4rSxmRV:ayWPcLKWvKeceu1jaClLiF7C4rSxmRV
TLSH
T18AC2E93B644CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 73KB
SHA256 3a0319af9bc79fa2d32d768c2c21fed29cccaa0dcaf8a81da64c973282c2650a
MD5 ac1da469b5525982246e1d02167c89fe
SHA1 041e9c1d27f916d59b8b252dddb69e48e82b3d98
SHA512 139974fe21500d61e6bb24a6d7347c42a8ed5ab165f685bcb3a4f1acebf7ef7477e575e543c756dfa77fbbdbe4b536fdc267e07962a461895caccc3a41977d34
SSDEEP 1536:tWQV6tWCt5iovwRJqd0+6VF31LijVQlOqdZkuYuVH:tWMFaiovWW+HlLYYOYZkuFd
TLSH
T1ED73021B47E571F278EBE3A1DC4DAB1CE1035161C5124A20DE164FA3E5684AF29F227F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 38KB
SHA256 96a874a36a161a53381e9c5b16dcc188a04da68d463130aaf505c0f08de38782
MD5 7edcfc856660cb38268d12020c19f321
SHA1 2681c51f50575a41e511d9466905216b29ed6c60
SHA512 ca7f075f61865b369cb7391113f48038648725b36c7c3b3578d910c0c154b5996788fb0fe56a2b4cb990e1ea54fd715d84d5ceedd539e3b98cb3ab3ab59487e9
SSDEEP 768:XytJ5hkIjw+b89qwAs46QVT6v1G9iXW75Vt/y4biUT/60sZt020:At8f9qt16IwOnJf/60sL70
TLSH
T12003F103AD345B43A628CF7AA59D1B3A22FDC19E95AC18CC4F90181B30D2F780ED6B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 69KB
SHA256 04d8c7b1d7f460e84057c514b3ba913bd0b86917dd036ab9a05bda8e6f911f41
MD5 acd7cf75ffdc5bcc208dd01ee857ca54
SHA1 07ee998bf88d714357b7cd7c825a4f0181d2e595
SHA512 2304fa8fcda642fea6b0c4ae720ec240fea476a3b61197b430e73cd0ade46cc7e12719ffa3e5ad5a36c2c0bef26df9f99a0c1af921b63bd634085daf3311620a
SSDEEP 1536:zLejXdrhuXIzL+prOZX44+ikpX/W4BOYQVfsKcgkWEu9:HMdoX8+c1R4/X4cgkM9
TLSH
T1C663023AC9CA46B4FA7063727D3176887E560F40FCE4F8961872A5E0B42A46825EF6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 36KB
SHA256 fdc9964050bfa24c27a3c76c6791b3674292a5f352cbc83d7a4dc49595bc3fb1
MD5 50b140b1e97d859d6d0603414f4298ee
SHA1 500e4872ee1ba9cf89f1ba626d64987b0f9ab5c9
SHA512 55ef84e956a7943e3fc61a8a349e64e9f35b7dfc63402ab52b995f43a7cd4b1d2acd300126dcdd610d0b106af426848f998ccf154f712034422d242d6ad9130d
SSDEEP 768:TLreREud92B1C5buEpioxWe6O1ESHFnLQkbknuF1dcjI5djeBX:Tu68248oxWe6O19H1zwnubdk
TLSH
T1A103E0D50DD6198AA53B3F7F467F0A3E1B12C429A57180F44A135FD32E169A7E910F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 74KB
SHA256 70e4d628843c8aa128f28b04653deba8bc351b4b868d4d6e9ada67a3e2cfb400
MD5 5c1cb34c1dd3766326afedfbef9f4aab
SHA1 da51bf4e974c86eddbca6e3b7e07967b21a08367
SHA512 a42ca1fe34d594fa550c9f806022d3c3674a7f03ccf0359b1bf623883b807fad668fdb2a05e89e4335a98a88bb94a8f9b47423e22f2bc9d882899ed6ff26de5c
SSDEEP 1536:sl9xog1rbd61Os/oqNREWWFkSXI0SlxUbW8uIl/7SpLP/v9:s5Fp6l/RvWFkSu/d7Il8Pd
TLSH
T1DB730260BEEE2E1A9C337F0F5D94C9852562FE9B60CF16EC4FE44D98D15C1E682402A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 24KB
SHA256 f9074ac7ced776e010599f95c47c4f0306f31db29414d5dd9d8b80a844ce009d
MD5 bd9541be6af68e4dcdf4d9363ac06f26
SHA1 8b648d53599ec344fa9790f8ad2ed045194d5e1d
SHA512 7cbab524ae46f03f742908ba800e3e1bcfa992c10e0da189cd4fc81c22760ff2bc37acddafe54b87cec1142ce4196744c1104bcb7a0592ee6b2f5bbd2051a58e
SSDEEP 384:jWiPFVfdUiuti5OjtUfdTvsHUhVnp3tHjK3ieS6+NZoWZrM/q6Cb5hkNC1bMT:jWePlEZijskrDK336NZoerM6kNCVMT
TLSH
T126B2F10342AEC9B5EF4D02CB64947A97F00BAFD831EB1541545DAC9B1EB1232FE181E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 e67bba08b17753de67fd5bbaabb36c0b9174180bd8bbc2b169db8df32811f59a
MD5 ba24ace6a9b8e49b2b0c177c232730fb
SHA1 e23a9ab45de755055e8bbca589438892b4b823f2
SHA512 08e4166cf205d8541254062726ece228af1cd39dfbca2db4b38f2e4d1d8a07e5594a2660ba6706017d3e950767234dc84fbd400fd54fb54bbb4958e6105d0859
SSDEEP 96:0I0S6rt/KAwDcT0KMIn6SlzTjlzSsBbSlghB/Q+z7YNkpO7HOXKqmkSnuoviqDCR:elucT0InDzTZzJB/LGkp2Oz61+g+5
TLSH
T16DB12FD087B55050EF68F4B9A5F91A933AB0C8792BCB1F9701A8C1365F073874629ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8cdb91737ece29f90c053d105d807e43971b3fd40696566ca6b84819c53048b2
MD5 e0cefbb07cc57ddb2a784d94afe44e3a
SHA1 35076cd513477370542219f977827fd7c875eb67
SHA512 3cacc5f51de90b1f709140ccfaa030c9dc853703bb40e5f15f8535bb02b4a11a70ad4a877040b977bf4ec14fa24efa3e69162a0d3dd6b1f91c4ccc915e868174
TLSH
T1A55171C48B705052E3A9C0F0A5F922C73AB0C8BD3F8B1E5205ACC5B98F4A353936C1DA
MD5 SHA1 SHA512 TLSH

Submit Download

d6f7c171-2893-4895-a057-b676690a8eb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d6f7c171-2893-4895-a057-b676690a8eb7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2070c7e1-54f3-4614-b6c3-349bb4b98d8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2070c7e1-54f3-4614-b6c3-349bb4b98d8c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8be2a3db-f39e-40f3-8d48-de542162f1b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8be2a3db-f39e-40f3-8d48-de542162f1b6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

cd5b2697-dae7-4edf-b9d4-9664f3ee3a1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd5b2697-dae7-4edf-b9d4-9664f3ee3a1c.tmp
Size 30KB
SHA256 a4bb6a23a4294bdb2bc612bd64af06aa6553279de4bf182dc8d3b01ea2eca222
MD5 1917bbbf97914bab7ebf42be5abbff82
SHA1 637e68aeb7a084ecf7cd49f5f8126306efc65783
SHA512 187b807883e3a696715bad2b2c3dac3c63761eb3f313c334c013a9a50114f3a7bdc47e3c6e16011f2527f21c2181b4d7ffd7cffce23eaef4e897ee8674116311
SSDEEP 384:DEs/7XSfS/AVE1FFjFRXMbTh5ezekJ2S8eNJqTL8BeBisolehGeve3belp1kIkwQ:FBHCoNaEr5++3pqd2e2s3h7k2eX
TLSH
T1B1D27AF783E5D62EC9111BF45614AE1BCF1D0A19432C3C1689D5EE8BE3E2032E15A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 d303f900805f72db94a4b8fca953251bac179b41a88a03c987aab8f1e04087c2
MD5 45ec0b5fd33fdc34a44499b79b631533
SHA1 13c848f723955cfa306f6e7f2eff36e673570bb3
SHA512 32778680ca8fe1c44e267df6451521066c50b7f8ce357a73839940eecc243d64c6d1640689da338036f62e5572963b260d3c0cdd2fc757fae8243f746119f7b8
TLSH
T10BA0025021B10941D5211371619186512A10AC5505454A01A8E05D57CE9A154DA61000
MD5 SHA1 SHA512 TLSH

Submit Download

f9d79243-ce5c-4450-a815-fce3e35df87b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9d79243-ce5c-4450-a815-fce3e35df87b.tmp
Size 11KB
SHA256 bb62bf8e1014c04341f20cb7b0b20a0934d407a3fca38c9079b466453bb4296d
MD5 9e1a9fe366e4ee683d6f20d0ad96611b
SHA1 e3a9ec2531b10c6f03264da5e9f747b938f3225a
SHA512 5ef07decce7ef55ab8601d9ff2376981ab22164d1bd8e8acb5a54030fb5172ec6a0a49bc89561e0090427b4e8f365bb83923698cdd1403447dfea69b022462fe
SSDEEP 192:sxZSRsnt/fSsL5adIdpXasZky1VHW6+WNW/XzkrrhXYapNFHfIg5zSJ:sxZSct/fSsN3XzHbOYRX9s
TLSH
T1F132B752BE34697B8CCAD259BA14BF13E6F9603291911E48E6FCCA1C05E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb7cefc8-5dde-495d-a8e1-27e3592d7178.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb7cefc8-5dde-495d-a8e1-27e3592d7178.tmp
Size 10KB
SHA256 aec0afa1293fe1291e8e94e3fc874b6cf03c0c9ba76c5eff5d345a609341309c
MD5 f2698d79d11fb65c2c2a748277a2338c
SHA1 57f654904d173074528a5bf74395cc1ecde5a442
SHA512 5064340efff24ad99171ad4e2f7238367515ae8c9c789ade5b15ae331e234b1a75726b209d343e7360af04bd52b0f7b3095d8f177a7c12cec8e38d15d369cfb6
SSDEEP 192:sxZSRsnt/fSsN5zdIdpXrhZqKHW6+WNkrhXYapW7HfIg5zgJ:sxZSct/fSsfCtHbOX0+
TLSH
T1BB32A752BE34697B8CCBD25DBA15BF53E6F9103291911E88E6FD861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e3db6872-fb78-4d9b-af87-e7039cc42762.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e3db6872-fb78-4d9b-af87-e7039cc42762.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d006a6322a0af400c9f37be50737a2e568eac4dc6bb4c62130cc4c071feb76c2
MD5 be08cd2fb54dc44ac065ed4ce31beaa0
SHA1 050f764daa19f91ea633f5903f2e57f1a80b9ba3
SHA512 0a6427dbb3847168216fcbd05fc864e407ab9d362b18905a014661177de2e38f254c2b70d6cd1c767efe51686fa860eb24a683b8b09fff9e2492bf38ea5b70ca
MD5 SHA1 SHA512

Submit Download

ab43e492-1510-4e30-b0ee-0a1ee4f498d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab43e492-1510-4e30-b0ee-0a1ee4f498d7.tmp
Size 8KB
SHA256 ead3feb9572b4d064b1bf9484b6ac8d88e7efb7f8c1915516df6ac4bbdda6321
MD5 f99d3e3838def67caf8b044d590d1fdd
SHA1 e02d04be3ce073b0a84a28297e57d6ef8e68555d
SHA512 033948ad02d22b163026f03e61b5acdca68191d19f3311136c0de8f9b16ab00c764556bcf069c40f37e1f216843900afa4bcc8981516d3783e73a5ef3d79b526
SSDEEP 192:9ON/6IEiQmiUybmTQuIGmuY62HReUU27H9q7OU6:9ON/6DenQuIGmuYBHLHrU6
TLSH
T11C120A36AC78BC6B9EA3A854F4873D23AEA54227E7857F94D5DC2A1C00DF25C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccd05fac-276f-4485-9303-2fa2f8cb0c4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccd05fac-276f-4485-9303-2fa2f8cb0c4f.tmp
Size 21KB
SHA256 0ec77015471dce37966569a6c50b4459cdba2f87cf341b1ce754a5fbcf918227
MD5 c70ac7a459226955171884ee2b974123
SHA1 cdcf941782c0c9c7e9148a0b6d98ef3c53be7534
SHA512 ea445486343a85023112ef6687082eb8cb86ea26646ccad7c3b111f730a513cf12935a593876aabfc4e8efc5ac3228ac4c676ed11741da9f8fc4483c9ab7e085
SSDEEP 384:MiFgQkUSviRsNG8TUNTUlIlJ4mbBc1D2lMzIGmuYBHrir2IuumIIlf:3FIo/wgUmbu0opYBLir5uumLF
TLSH
T1DAA25D339CA8AC7BDEB79E50F94A3513DEB44157D6C5AFA4E6CC6A1C01CB29C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7d0ff79-5d28-4771-8336-60731edbabbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7d0ff79-5d28-4771-8336-60731edbabbe.tmp
Size 392B
SHA256 d8819503c3662f4088b67a1de3e128e61d23ae80d08487c40cfb22eec9326358
MD5 e018105b699dae006e62b6f351371822
SHA1 18efc728ce7e446d0d632d2d1ce07fec654697ad
SHA512 836fcefb85a73488bf5549e4395ab3b77d5dba4a708a534915b7f8e6a7fd25d8180bd382061f651c57662fdf88c6c4a0a39fe2e19c8d738c3f1c0bd43ce560fd
TLSH
T157E00403D700117DD01C113530431F105F53D47014C407071F35015D1C343553DD0F41
MD5 SHA1 SHA512 TLSH

Submit Download

ee35c7d7-0941-48f9-873c-633be3046d19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee35c7d7-0941-48f9-873c-633be3046d19.tmp
Size 392B
SHA256 47a938538eae74dc5f9f517ae6f999dffe96d62f77d7f90629a731ae967ed21b
MD5 a7cdd9c1bf8746432291bf31d98954b9
SHA1 a4643f5ce73bdc40a059f2446dcd2fd4e393bae7
SHA512 5a3da07261997c57ff97a7d2e3a92e18acb715693f5f131b49ba4705cc68312c388cea3e79eb4036192a02a28cb05e7592ba9fd549cd41e8c8c7ca855ccd136f
TLSH
T120E00102970011BDD028123520431F205A93947014A406061A2501591C263552EA0F81
MD5 SHA1 SHA512 TLSH

Submit Download

156aba07-75b2-4788-a881-18a97fd18ec6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\156aba07-75b2-4788-a881-18a97fd18ec6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8a34d3c14a9284a5104b6cb5afefc331f9cafd2d40860eaa5a0e18416d7f0591
MD5 1fe5e33a074c85b9f1ff413c4bf5b357
SHA1 f54099f8848b2d45dadb7256de19c820ea1b5307
SHA512 5dfbc7a106ba3186272cb1f244b63bb3c6f8ed4668009b4477b59911e805435a7f9b7987c4939e2191f19c79fb348c8655086bfe9db48b5f7e013447bb3c49b7
TLSH
T146413A48A2ED1144B3B77F4AABF698AD487ABC372F0A945E10110E4F0667F44CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\_ctypes.pyd
Size 131KB
SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
MD5 b865b6717d0bb9c909c21997e5e43878
SHA1 6b7bc1d2d8a5fa1816b8c83806c8bda0d766c4f6
SHA512 a1cd8e5e1bc5b5ee78226eb9a3dbc2054ae7ca2cddb592eb287606aae3ade7e76f821b036837aff15675a177938418d8030841b3fab667c0288235b2595abb75
SSDEEP 3072:iuZHKSoKYuYz5sdf/FVzy4PKzblEUS1IIyP7Tv:doR8f/FVzyIKzKUS0v
TLSH
T1F5D38E0B776800AADAA78178C533AF47EFB1B453161057CF02A4C59A2F63B966E7F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\base_library.zip
Size 1.3MB
SHA256 603659b741abd7bffe5201d2b6f1f073ef0ffb0e3949067c53cb54c00b154afc
MD5 98e534b0cf587af60901fcd2470f628b
SHA1 84e55ea646c84b62f94bdb1ce3f995eb04c44903
SHA512 b2a596d8c3a0b5c4b2066e7a7245b8dec76c5646505314fbd8b480949ad17777652a8725b431a42785b49adc66da354fb53f5662d2a6769d58d5593c67e6e165
SSDEEP 12288:PdjdTmuIva80201jwCVRDVoioSYBHi2cPPdxhYLqwt9iL+DUiu9sjEA75YZQ6PWI:PdZmlH5cPPdxhYLqYjZ7Wp9SuTxf9
TLSH
T1AC551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\python3.dll
Size 70KB
SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
MD5 2862d7a3de70a60be154aa7590cfeef5
SHA1 74cee0f36417a8f2ec213c8f0c755a40bbb8a051
SHA512 3fe520a0928b2af4a20e73a7943059573f965eff3ac59f6f03f5a2c4761301dc0ff42c7f87baccb2eaca2ea3bb83d84d81a1e0f0e04a5a2d2a4745b4b30ab7cd
SSDEEP 1536:FotssyKcunV8Po1IIy0Sy7NsR9QWfILQB:+tssyKf1IIy0jXi
TLSH
T1AE634CC25B5BF8A2D6F665FC78DDD9CE242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\python313.dll
Size 5.8MB
SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
TLSH
T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37482\ucrtbase.dll
Size 1.1MB
SHA256 27247c9dd53eac1939e830fdcfeec3749ee84a1c8fdbe685e1229b09663679c2
MD5 e2be135be35dff4bb1acbdd0364a3126
SHA1 47dc2254940878f4ad2266d67548ca1acdf3138a
SHA512 8bd18198d613940774c96b2784ec2e7430c393d46909d2a81b8a01092d2dcb8b97f6503a417a60dc85318e33647cc13100139cb4c9188fb63c947c9930c6897c
SSDEEP 24576:+JG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNHK:V/qtvdhq+BaPHxxdk
TLSH
T135359E28B75C02AAD97BE17CC923550AF973780047709ACB03A74BBA3E277E556B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9b45201-31b0-41cf-a635-ff87c557f844.tmp

Path C:\Users\Admin\AppData\Local\Temp\d9b45201-31b0-41cf-a635-ff87c557f844.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaSetup.exe

Path C:\Users\Admin\Downloads\OperaSetup.exe
Size 3.1MB
SHA256 b31873b5247f3984fad6e945fb5a28df1e985134589b58d14e582ccf939e0e6d
MD5 5537a7094798090f831bd504bcef7a90
SHA1 ea5116d93195e335c253220395efcdda54c0f484
SHA512 c5957979ad68c62d57fddd01e35edb92768846027e748d65db45f939e1983f1e0c7c5fa9191337e22583656c0f8039d201f0fd8fa2792096bc11b4ef905398bc
SSDEEP 49152:lVAbw6jmOOWdfw3DpKXlRdCUfY6Ca3y1fLD01cCdbwO8yxpXDVmCvgwU:TAJ6OOmf4elnCSY4CNP0yCdbwIJwC4wU
TLSH
T165E523127B84D071E62212320F06FB6961BDFDA10F758A97B3882B1F9EF51829635F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc0569e8-c17d-4db9-bb82-1345ea2628a8.tmp

Path C:\Users\Admin\Downloads\bc0569e8-c17d-4db9-bb82-1345ea2628a8.tmp
Size 1.1MB
SHA256 e0b7abcd808b96042ea091c27820a56197c23679c610656be134fe02f69d0077
MD5 4f351c0c87d1b29033ec7e1c74096cc8
SHA1 d890eaef0d3922eee2d4bd096b160d20d72384f0
SHA512 80870d8a8abd76191c3fbb435913530e64850caff58d1b2c9ca1a418682619cbb0636cfc06ef40afef585d55e647e5daaced0c8fd0584faae39e00eec122743a
SSDEEP 24576:yV9virgVAC6wGUYlpr0Uj/ClLSmnOOpkdf83ytYfrpC:SVAbw6jmOOWdfw3DpC
TLSH
T1F93502527B84C475D66212320F5AFBA892BDF9710F36DA9773882A1F4FB01819635F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f529773e-b9f4-4f92-81a3-8cdc04d8fd22.tmp

Path C:\Users\Admin\Downloads\f529773e-b9f4-4f92-81a3-8cdc04d8fd22.tmp
Size 15KB
SHA256 d39d458ff90aa2a16ee53e80ac2e42eb85d12873581867e8b99487a66e32f2b8
MD5 80a251d2a89cf12d4e04539075b3c986
SHA1 7ea62779d081c088b62651f5f3940da5cd77f23f
SHA512 dd5c63066c4ca3a83ba2f64c41f43320e2b7221144c71c66fb00ead6a16463c53a7bf236e84813e53058d22604363b9e813ffa4b588bdda5c69ab8f26f931969
SSDEEP 384:k+N87hM5lelZ9GwEfqzWXKEvGsLC6xeZ8BQNZy4:uvrEfqzWXbXtQ8BQ7
TLSH
T1C272282587C781A0CBE7CE326D057DAD7C6DBBED120877111E12E82BA28CF6E40D7261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6040-1893-0x00007FFDA79F0000-0x00007FFDA7A19000-memory.dmp

Download