hxxps://cdn[.]discordapp[.]com/attachments/1552748843685118062/1560993196799041546/Free_Fortnite[.]zip?ex=6ad80773&is=6ad6b5f3&hm=74beb0095f67b2659485169b24dcd59b4c0adce53e86c0d96433f9664bccf49f&

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1552748843685118062/1560993196799041546/Free_Fortnite.zip?ex=6ad80773&is=6ad6b5f3&hm=74beb0095f67b2659485169b24dcd59b4c0adce53e86c0d96433f9664bccf49f&
Sample261020-c5k2datzf1

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5792	takeown.exe
260	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5792	takeown.exe
260	icacls.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	Free Fortnite Saryx.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	Free Fortnite Saryx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 55 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5956	cmd.exe
4948	cmd.exe
5468	cmd.exe
1252	cmd.exe
5324	cmd.exe
3744	cmd.exe
2320	cmd.exe
6028	cmd.exe
5496	cmd.exe
4288	cmd.exe
6072	cmd.exe
3088	cmd.exe
5196	cmd.exe
3772	cmd.exe
5160	cmd.exe
5936	cmd.exe
2420	cmd.exe
4264	cmd.exe
3192	cmd.exe
864	cmd.exe
5164	cmd.exe
5472	cmd.exe
5536	cmd.exe
5680	cmd.exe
3112	cmd.exe
5872	cmd.exe
3380	cmd.exe
5456	cmd.exe
5696	cmd.exe
5092	cmd.exe
2628	cmd.exe
5156	cmd.exe
5752	cmd.exe
1788	cmd.exe
5704	cmd.exe
5864	cmd.exe
6052	cmd.exe
5328	cmd.exe
396	cmd.exe
5912	cmd.exe
3016	cmd.exe
1560	cmd.exe
5336	cmd.exe
5868	cmd.exe
5216	cmd.exe
5428	cmd.exe
5716	cmd.exe
5888	cmd.exe
5420	cmd.exe
5248	cmd.exe
5516	cmd.exe
5540	cmd.exe
5712	cmd.exe
5236	cmd.exe
5408	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3016	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
5152	taskkill.exe
3728	taskkill.exe
5500	taskkill.exe
5692	taskkill.exe
5780	taskkill.exe
5912	taskkill.exe
6012	taskkill.exe
1152	taskkill.exe
4884	taskkill.exe
6092	taskkill.exe
5236	taskkill.exe
6020	taskkill.exe
5772	taskkill.exe
5228	taskkill.exe
5920	taskkill.exe
5600	taskkill.exe
2804	taskkill.exe
5328	taskkill.exe
5380	taskkill.exe
5860	taskkill.exe
5488	taskkill.exe
3728	taskkill.exe
5680	taskkill.exe
5756	taskkill.exe
3620	taskkill.exe
5196	taskkill.exe
5880	taskkill.exe
5484	taskkill.exe
5204	taskkill.exe
6024	taskkill.exe
5244	taskkill.exe
6032	taskkill.exe
5596	taskkill.exe
5692	taskkill.exe
2960	taskkill.exe
5144	taskkill.exe
5916	taskkill.exe
6048	taskkill.exe
5196	taskkill.exe
6048	taskkill.exe
3040	taskkill.exe
5908	taskkill.exe
5448	taskkill.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	Free Fortnite Saryx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	Free Fortnite Saryx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	Free Fortnite Saryx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	Free Fortnite Saryx.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	Free Fortnite Saryx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{B6EBF3F8-0DE8-4908-9B20-E2FA02BEECC7}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	Free Fortnite Saryx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	Free Fortnite Saryx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	Free Fortnite Saryx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	Free Fortnite Saryx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	6092	taskkill.exe
Token: SeDebugPrivilege	5196	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	5448	taskkill.exe
Token: SeDebugPrivilege	5500	taskkill.exe
Token: SeDebugPrivilege	5680	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe
Token: SeDebugPrivilege	5916	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	5196	taskkill.exe
Token: SeDebugPrivilege	5236	taskkill.exe
Token: SeDebugPrivilege	5328	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	5380	taskkill.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	5912	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeDebugPrivilege	6032	taskkill.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	5204	taskkill.exe
Token: SeDebugPrivilege	5228	taskkill.exe
Token: SeDebugPrivilege	5596	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	5488	taskkill.exe
Token: SeDebugPrivilege	6012	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	5152	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	5600	taskkill.exe
Token: SeDebugPrivilege	5756	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeTakeOwnershipPrivilege	5792	takeown.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	Free Fortnite Saryx.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4280	4224	msedge.exe	84
PID 4224 wrote to memory of 3564	4224	msedge.exe	85
PID 4224 wrote to memory of 3768	4224	msedge.exe	86
PID 4224 wrote to memory of 3768	4224	msedge.exe	86
PID 4224 wrote to memory of 3768	4224	msedge.exe	86
PID 4224 wrote to memory of 4500	4224	msedge.exe	87
PID 4224 wrote to memory of 4500	4224	msedge.exe	87
PID 4224 wrote to memory of 3712	4224	msedge.exe	89
PID 4224 wrote to memory of 3816	4224	msedge.exe	90
PID 4224 wrote to memory of 3712	4224	msedge.exe	89
PID 4224 wrote to memory of 3712	4224	msedge.exe	89
PID 4224 wrote to memory of 3816	4224	msedge.exe	90
PID 4224 wrote to memory of 3816	4224	msedge.exe	90
PID 4224 wrote to memory of 3728	4224	msedge.exe	91
PID 4224 wrote to memory of 3728	4224	msedge.exe	91
PID 4224 wrote to memory of 3728	4224	msedge.exe	91
PID 4224 wrote to memory of 4944	4224	msedge.exe	92
PID 4224 wrote to memory of 4944	4224	msedge.exe	92
PID 4224 wrote to memory of 4944	4224	msedge.exe	92
PID 4224 wrote to memory of 312	4224	msedge.exe	95
PID 4224 wrote to memory of 312	4224	msedge.exe	95
PID 4224 wrote to memory of 1252	4224	msedge.exe	96
PID 4224 wrote to memory of 1252	4224	msedge.exe	96
PID 4224 wrote to memory of 4816	4224	msedge.exe	97
PID 4224 wrote to memory of 4816	4224	msedge.exe	97
PID 4224 wrote to memory of 4816	4224	msedge.exe	97
PID 4224 wrote to memory of 4884	4224	msedge.exe	98
PID 4224 wrote to memory of 4884	4224	msedge.exe	98
PID 4224 wrote to memory of 1968	4224	msedge.exe	99
PID 4224 wrote to memory of 3432	4224	msedge.exe	102
PID 4224 wrote to memory of 4064	4224	msedge.exe	112
PID 4224 wrote to memory of 4568	4224	msedge.exe	113
PID 4224 wrote to memory of 1788	4224	msedge.exe	114
PID 4536 wrote to memory of 3192	4536	Free Fortnite Saryx.exe	118
PID 3192 wrote to memory of 4504	3192	cmd.exe	120
PID 4504 wrote to memory of 4492	4504	msedge.exe	121
PID 4536 wrote to memory of 3744	4536	Free Fortnite Saryx.exe	122
PID 4224 wrote to memory of 2604	4224	msedge.exe	123
PID 4224 wrote to memory of 2604	4224	msedge.exe	123
PID 4224 wrote to memory of 2604	4224	msedge.exe	123
PID 3744 wrote to memory of 3432	3744	cmd.exe	124
PID 4536 wrote to memory of 1788	4536	Free Fortnite Saryx.exe	125
PID 3432 wrote to memory of 1560	3432	msedge.exe	138
PID 4224 wrote to memory of 2804	4224	msedge.exe	127
PID 4224 wrote to memory of 2804	4224	msedge.exe	127
PID 4224 wrote to memory of 2804	4224	msedge.exe	127
PID 1788 wrote to memory of 1128	1788	cmd.exe	128
PID 1128 wrote to memory of 3712	1128	msedge.exe	129
PID 4536 wrote to memory of 2320	4536	Free Fortnite Saryx.exe	130
PID 4224 wrote to memory of 3032	4224	msedge.exe	131
PID 4224 wrote to memory of 3032	4224	msedge.exe	131
PID 4224 wrote to memory of 3032	4224	msedge.exe	131
PID 2320 wrote to memory of 408	2320	cmd.exe	132
PID 408 wrote to memory of 2284	408	msedge.exe	133
PID 4536 wrote to memory of 3772	4536	Free Fortnite Saryx.exe	134
PID 4224 wrote to memory of 4320	4224	msedge.exe	135
PID 4224 wrote to memory of 4320	4224	msedge.exe	135
PID 4224 wrote to memory of 4320	4224	msedge.exe	135
PID 3772 wrote to memory of 2388	3772	cmd.exe	136
PID 2388 wrote to memory of 3972	2388	msedge.exe	137
PID 4536 wrote to memory of 1560	4536	Free Fortnite Saryx.exe	138
PID 4224 wrote to memory of 796	4224	msedge.exe	139
PID 4224 wrote to memory of 796	4224	msedge.exe	139
PID 4224 wrote to memory of 796	4224	msedge.exe	139

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
208	attrib.exe
2228	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1552748843685118062/1560993196799041546/Free_Fortnite.zip?ex=6ad80773&is=6ad6b5f3&hm=74beb0095f67b2659485169b24dcd59b4c0adce53e86c0d96433f9664bccf49f&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7fff9505c188,0x7fff9505c194,0x7fff9505c1a0
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,9202757114773248951,10629161153197848887,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,6170635391109634580,5437678059605015170,262144 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,12826066643991221641,610549757016800657,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17077692655901888706,20994493558506683,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6462502112273568230,9633543644213879299,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,17597171703149980479,18161144169565819437,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,5874721914863018217,15257313910770971615,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12762148080503019293,4775664277046846504,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,9551429563951807732,12813099736176715454,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5656,i,2127884019213797114,8759458861329007433,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,8602295216541279191,789361105041177573,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3578862158602980022,12433734276807730921,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3843259443619832410,2201099107857037074,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3843259443619832410,2201099107857037074,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,18362077840263073868,13735252277794786756,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15034357840293687279,3522000873809659139,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,630650054783980776,9674764815903289637,524288 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5808,i,17844998102880778481,2535646768352006578,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4220,i,1317118080441821296,7643954222596544729,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5400,i,8941232719258848722,12545554614872826866,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7152,i,10358335406247797096,17516816823284090987,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4264,i,15238135373780690531,2678006929391427332,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7024,i,14517880099928159925,5516502953140459459,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7348,i,13408918206688184561,9267642983772899790,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7500,i,1982836879669949325,12758042529792497498,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7684,i,6770352393118406066,14817025259231461445,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7844,i,2768358790320921436,10518348206002800230,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8020,i,1254178845090858033,9632362663276231850,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8184,i,5919938151224811436,14539905320687325536,2097152 --field-trial-handle=2292,i,9584210305268226306,15163918171731930522,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1160

C:\Users\Admin\Downloads\Free Fortnite\Free Fortnite Saryx.exe
"C:\Users\Admin\Downloads\Free Fortnite\Free Fortnite Saryx.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
      4⤵
      PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
      4⤵
      PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
      4⤵
      PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
      4⤵
      PID:208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
      4⤵
      PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
      4⤵
      PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
      4⤵
      PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
      4⤵
      PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
      4⤵
      PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5160
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5516
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5888
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5156
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4948
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6072
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\MyCheat" /f
  2⤵
  PID:5344
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5144
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:5744
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:2920
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
  2⤵
  - Views/modifies file attributes
  PID:208
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
  2⤵
  - Views/modifies file attributes
  PID:2228
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3040
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0acfd55f-e87c-41d0-ba7d-11ada7c6b4de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0acfd55f-e87c-41d0-ba7d-11ada7c6b4de.tmp
Size 18KB
SHA256 85afe341220dc6be862cc6c588dcedb183ae823a916c9f145c84d328c1f7063e
MD5 8331573390d001d1579d2587b6c24210
SHA1 00bdfb40e722b6ed26acbadac622b7e779d8876c
SHA512 b9bbbbf48479a968130b7d70a726cdf0b52680f93f806905596516df6f4b8ccd81c5e08f012f393de0c711b87692af9c1864df445f83df92ae2ca68ed7cfe13d
SSDEEP 384:0QkUSvOsNz5DWE2fikPf2QX5+Dtyz8G46XXhgNIIlr:kOy2fLf9kDY54iXhgNLR
TLSH
T16E826C356878AD3B4EE75145B1893283DEB4A11BEAC92FD0D6DC5B2C00D92DD230BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c7ccc5d-edfe-46fe-9867-25a11b4a1f1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c7ccc5d-edfe-46fe-9867-25a11b4a1f1c.tmp
Size 18KB
SHA256 b4f0489a868d1c6630ceffd3d24f0fca17802f64df7a097a06e0a0e727fd66af
MD5 314a0a1c2523717953abd041765e821b
SHA1 1b7fa0e977292538e8aa5320c230d0292b25eb25
SHA512 f8f17614b61db8167c6f43dd402dda8b5471b66f082adae16ee1592c4491a22ddec95b94b6e25ea3e2cff1b6d1141321e4f03e95c376e4bef14c074f0734de51
SSDEEP 384:O4QkUSvOsNzuDWE2fiF7C+QX5+Dtyz8G46XMhgNIIlr:5OP2f5VkDY54iMhgNLR
TLSH
T157826C356878AD3B4EE75145B18932839FB4A11BEAC92FD0D6DD5B2C00DD2DD230BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d368336-6629-4943-9b49-4b3a081438cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d368336-6629-4943-9b49-4b3a081438cd.tmp
Size 8KB
SHA256 c6ab50239ffc3ba045bab8f6d674babb4ae251c5c2ea44141d4fbd42c454b7c4
MD5 cf4858866f045f27f9a18d5cf2380f23
SHA1 b0f35ec20a77413f7d30c45a7a342748b13a371c
SHA512 c875010582f3e79d162a95570af836729c79452a0489e0ceaf42bd3052c3722635baff9d8b4bf11cc3d37f022faf7d60ce602a3482ce1c6e4a5f345d567e1bb7
SSDEEP 192:gON26nnHaQmiUygRgD6YcX5hQDP1yjjzorlo46XFzg3aq5gU6:gON26n2w6NX5+Dtyz8G46XmhgU6
TLSH
T1B6121B31A8B8EC7B5DD26995B0873113AEA55127E6897FC0D6FC1E1C01EE6AC130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f470f73-b98c-460d-b209-cab8e1a9c771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f470f73-b98c-460d-b209-cab8e1a9c771.tmp
Size 8KB
SHA256 e86e25e1c8e1dce09363ef3a5d2c15f5e8b2307cb093e28e4c26125421746246
MD5 d0cb387fc471bf82c7012b4043c46810
SHA1 5bd6509d38dd8bd82e2c52c1461f9a88dada235e
SHA512 0c15e28b3ccecc65caf06b5f419717797406998a1f424a586777893463f8906aed94a4a98c0b63770f63fa82b4f669bb9689cfb82128c7b96a23ccb6a5c4f6e8
SSDEEP 192:EONh6nnHGQmiUygFgDQYcX5hQDP1yjjzorloQMcLNfU6:EONh6nCAQNX5+Dtyz8GERfU6
TLSH
T13A02DB34A8B87C7B9EF36D45748636139FA5216BE5952B80DAFC0E1C00D769C230AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

693a9d66-3f7f-434f-850b-253ee1d867e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\693a9d66-3f7f-434f-850b-253ee1d867e1.tmp
Size 18KB
SHA256 8cb80250a636abf456796e83ac7e64803592de4a43f2cfb115b2b255b512e325
MD5 aa758f06d1c8cea4dd51139eda237693
SHA1 cd61d9a1aec08d2c2af4a3ca8e0a9f4b247b1079
SHA512 4795fe191128d5b5ebdf91a32e09a44bdd1d3aa517d05eb76297a84f7fa4969495d7121a99ab9b396e21d1b4ec39a1768ac579005cbe3f7d0e5f9ede33d515ef
SSDEEP 384:i4QkUSvOsNz5DWE2fiF7C+QX5+Dtyz8G46XMhgNIIlr:9Oy2f5VkDY54iMhgNLR
TLSH
T196826B356878AD3B4EE75145B18932839EB4A11BEAC92FD0D6DD5B2C00DD2DD230BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92a09006-6cb8-4d35-8316-9b85f6c76bfc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\92a09006-6cb8-4d35-8316-9b85f6c76bfc.tmp
Size 22KB
SHA256 075987561bca65d20dcb4425189ce5da2b85447994aec61606c7ed43c36c8faf
MD5 38dd82558d2fc54d83f778648fcb0692
SHA1 45accacc0a3b31c290684ab3c70746392bb9fa9b
SHA512 ac80e9c76257838f969009199e492c44fce628db64045b9d46b86e7a9336bd30409380e5e32c894413e60bdfaa8788ebc575538532f656e9658a5ac168cc1bfc
SSDEEP 384:5QkUSvHsN25DWE2fiknEQX5+Dtyz8G46XXHvvKASB+tdoPMKwIr+VNIIlr:bHN2fzvkDY54iXXtSdEKwIr+VNLR
TLSH
T12EA25B75A8A4ACFB4896E0C4B145F143AEA49137D58D2B9CD6FCBA3C309F1F82316D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 008fe2bd4df1b5274500da9bc5ca2d0078b4c67299e5a59b07ba0ea59b15fa5c
MD5 ea4defc91533177d9419b56a904c3169
SHA1 03ace1db6d747cfe7c45b8741b11a55e039422e5
SHA512 4e2f45b8ce5ef686f67c65748b87b688c9bcc0843d3b1966e31695e359582622844f65a940e7236c2aa296f7c07697173eb1a70054c3666de4f4461e1d475fe2
TLSH
T14ED0C002FD173EFCC0EE1470002CC0040A44FA134600114006131D198C24101386CEDC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

29d9c737-54f8-4fce-a9b7-ce13575becfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\29d9c737-54f8-4fce-a9b7-ce13575becfe.tmp
Size 9KB
SHA256 a889e66039d42ac26f6870e1a63552b3e4916dcde16f4bbccb117d8faf55bed2
MD5 93db660295a58d557bc137592c0a2c6c
SHA1 9f78536f2dfdbceb206fc23100ae47688a73963b
SHA512 00626d832d2d4908f6ae4add5376510607c92f8706f807ea31003d1197d010473f6912699625f3dadc5944ee19da659f6b54377d6b2e0584cf68896af07087a0
SSDEEP 192:sxZTRXnO/fTsgRIdpJHW6+WNGYYBXWE7WnIg5oJ:sxZTxO/fTsgaJHbGf8ne
TLSH
T10722B8526E38A53B8CCBD20DBB55BF43E5F9503261D11E58E6FC8A1C05E6ADD120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8477389f-fa48-4ae4-8c24-4a9f2b6d9089.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8477389f-fa48-4ae4-8c24-4a9f2b6d9089.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c57317f-4c51-4556-a0b8-b296efcc2458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c57317f-4c51-4556-a0b8-b296efcc2458.tmp
Size 10KB
SHA256 dbc9ab725df42ce5d50ead6afd30d5bf812ed1f41ca13dcb9866dd4062c61c8a
MD5 78b192bab2e8013310cd592e3796257f
SHA1 a890a8f5e6295e05ec6bddab24ad8bdcfb641077
SHA512 36e5b8dcfb721e53e1ba87e9bd47b14e0f976fbbe7094cff0a365e8e41ecffda8819f8fba0acf468333f360a11a0a4cdb6e71819e27d9317e349f9014a82cca1
SSDEEP 192:sxZTRXnO/fTsOkIdp8tMHW6+WNn7ThYYB9WW7WnIg5KJ:sxZTxO/fTsO9xHbnhfanM
TLSH
T19722B7526E38667B8CCBE20DBB59BF53E5F9403261911E44A6FC8A1C05E7ADD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 91788b1d092823acc17d6996aaf2353568e097597addfad7cceeefb771a08306
MD5 0c0037841df725bbab7e1fb36a11a654
SHA1 7a77156f0f8edfe71eaf8097f073565bbc1c8d55
SHA512 7daeb475788c4321ce2a18778bc4d62a5c319fc48d1a3fdbae196faa142d28d11635e5362093c6afc92e7b9024129fda77ef2c3cf19b34a637cdc120f09cfc53
TLSH
T1A5515D8026614D94FB5E617C63F2A1FB31B2F6B043830E0D3A64CA792B3675B808089C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 74ad33350694ec9d78eede87acde991398a4b5f6a7b9322f0faa0920e2e04dc0
MD5 5d358d17f875a078e40fc59840510eeb
SHA1 653cbbacddbe4fdd0548864fbf5fc6ccdd13bc36
SHA512 0ee7efb8671649701b344112b55546214841096e07db70618b5971b7c8cf13221a8719dd0f5dd5c4b24d9c12609ff39adace1b31f41802ea9f8f846f27a2a129
TLSH
T1F6515F4026614C94FB5E617CA3F2A1FB31B2F6B043831E0E3A64CA791B3671B808048C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 226aa6dfeb9900703fad68a69fa6bacb0b5f417210752525faeb24c087439cfd
MD5 d3b2a3ed3e18fa6f3acd88240fab1a12
SHA1 64809d7b8d630e30004a3590ed4b9102c20fb848
SHA512 2135dbc7e4fdd4e4ca9e856673de20c43f3a07f53292f6e6502fe4fa4e086661b511ce7fbe5019bbc4e5e24cf73f5a57392921ce5443cc90664f27c647e0f7d5
SSDEEP 3:MsEllllkEthXllkl2zEklsxpe:/M/xT02znQpe
TLSH
T1A84404047FC14C07CF0014754C11C3500370D7144D11F7433C5154137CDD5400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81a39fea-ced0-48cc-a02d-bc54d7ec69b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\81a39fea-ced0-48cc-a02d-bc54d7ec69b3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5297e165-aa39-44f2-b93a-a00709ea58df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5297e165-aa39-44f2-b93a-a00709ea58df.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

58ba0eb7-5995-4096-a044-fbd84cc8f223.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58ba0eb7-5995-4096-a044-fbd84cc8f223.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c57f8100-0651-4a21-bb93-e43265719be8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c57f8100-0651-4a21-bb93-e43265719be8.tmp
Size 1KB
SHA256 0609b219529481ea44b57681751d1760c1638c1c66e36435a978f7f2be30cdde
MD5 2d98fe410e736103b0ed237c7fe1d235
SHA1 a0475d591bfcc2dc6bea779a2d0dce313cc5db54
SHA512 b3b1047c30e4f6248dd13c5b34ce745d4b1fa9065f144176f470e58104b046e9872d1c2f3c0059be6af3de2b05589c467190b1684a2c190725f3cd385da48436
TLSH
T17921AAF3C7E5866EC91116F06A14AE1BCF2D055842293C1A89D4EF6BD7E3076E04198F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3a358bc090a5bd96685a47ff4212496532a52808bf9c491cdef4f4a1be990aaf
MD5 c3afb38d09436dd6d16a784e5d4fc456
SHA1 c78da711d92625fd057d0fb6aeb04fa83550bc23
SHA512 dcb0c80e108ca6a91f69f35caba1650c78875d683eff4b7b0346d0a166d6939d82ee09ab6325b37f1981295faeed53d0e976a9b5bfea8ab994df4c212069a3d2
SSDEEP 96:K0VCKOMq2z7PyT/95V89pgn7n8KTp718/v/ANvhAHKrXVxdU9RYf7fUKTR7dU/X5:E9gPyT/95Vkpg7nbp71kv/ANvhAHKrX6
TLSH
T1D6A1AB1175BB1A1438BE298D85B4972A524136733218F52ABFFD04B69E2FE044DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab6f1f3c-2250-4176-921b-5ebb37a81e8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab6f1f3c-2250-4176-921b-5ebb37a81e8a.tmp
Size 9KB
SHA256 dbb91f9f6f4f2a5df451dfefed675db1582e593674e76e6afa4a624230fdab40
MD5 1535c26a97e26d5be5a13468c48ecee1
SHA1 8d756f857f0c02ef10fc44eb7872b0c9085d0d70
SHA512 6a59b6f5fe66086e93112825333c5f5ea36b8eea48af41cdd4a0edb58c3e05450142176c6161fc71dd44a219aee11347f2aa5f6f265100704ba46a089b45478a
SSDEEP 192:sxZTRXnO/fTscRIdpJHW6+WNGYYBXWE7WnIgrJ:sxZTxO/fTscaJHbGf8n9
TLSH
T16412A7526E38A53B8CCBE20DBB59BF43E5F9503261D11E58EAFC861C05E6ADD120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf868667-82ad-4941-9c05-6c5deadf1cd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf868667-82ad-4941-9c05-6c5deadf1cd1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ebfe2c2f-8ed2-44a8-a5e7-e9f7dddafeae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ebfe2c2f-8ed2-44a8-a5e7-e9f7dddafeae.tmp
Size 27KB
SHA256 97b621b3066fdee889d50136dcca77d59c51916339d3678b8983c5527d822f1e
MD5 57c29f7ec63ca7f9d15f5797dc32797a
SHA1 b89c9c62dc01599fd37dfa7debdc5b685a69ee97
SHA512 75829297e4876da731d35f584d06c6908c28c8bf6bef74778156d82fbc72634c8382c48827fa554fbcc18c023eef9c1c663aa3df999e1465f6c67673415d0f76
SSDEEP 768:FyyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXGropUV2F:FyyYR7jWv3NpBu1ja/CL8OX9Ai
TLSH
T174C2E92B640DCB7E4FC01A9DDC5A6FDB2E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2b54a51-4c64-4296-ad1d-f739f6ec438a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f2b54a51-4c64-4296-ad1d-f739f6ec438a.tmp
Size 11KB
SHA256 86f2246dd7e1676700a7b78b8f2fef6c5e974e98c9ed79b8bf32c7ab8a36c892
MD5 2363bc728bca2274e9801a7d2c8c9442
SHA1 cfe6f1519031501a48bab6e7a411e4c259c3faaf
SHA512 9a3140bba4c037f83ab5dac01cd2451d0744599a0fc35e48230183de5dbd20560cd6807ebd8ba95f82fb8cb9ef43b59a5358de37b27ca58e1f78768a1202ce36
SSDEEP 192:sxZTRdnO/fTsVWpVR6Idp8tMHW6+WNZa7ThYwBJirknIgbKJ:sxZTXO/fTsVWvRTxHbIhjBnC
TLSH
T17232E7526938A97B8CC7D20DBF59BF53E6F9503261911E44AAFC8A1C05E7ADD220390F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserMetrics-6AD6D48C-8EC.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\DeferredBrowserMetrics\BrowserMetrics-6AD6D48C-8EC.pma
Size 4.0MB
SHA256 9f93bfe8426517640f8a567d8530115ab0b5cc6a269bd3e3fe549b36740a1cfe
MD5 98407da7b1502d502bf1ee9d6cf746f4
SHA1 8861a0d7bc6badef73c8a7c3ef948173cc094ac3
SHA512 f3f114a29011cf6ee8fb37fe353621660a913393bfb0603e8fb6e16f3cac2a60c50609ad88bef8cb2325db2681dc118f1c97290dbd433899706043b6e78bf757
SSDEEP 96:bIHUClM+Pd1B/KQNf3zCvECssoDnW8yU88y08cy4Gcm8GIRgehGORBQUBRh722eZ:cf1gQspjn8y08Tcm2RGOdBne
TLSH
T13F162B247BC84F6BC5C3AC71CC7E0B5815E0D5955729C14B2221ED0F6F1ABC45F94069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7124153e-4904-4935-afac-1857b10052a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7124153e-4904-4935-afac-1857b10052a1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37ad3073fe4e3b77e3e872c861fceb5d9a4cb2ffb3bb4acb6fe17e0609a64db9
MD5 306c717fb713f852d7dd893458f8e92f
SHA1 bd8ae5a54bb4ae4739f064c94335119957781051
SHA512 dfa5b006c835424a0a063621168f92ac9106899f7cfd50499ca330c53e46040a16d36d09391bf43b0612c39a2c43fdfa4e3e32a7c25fb56fbd0ac2dae23fdfe1
TLSH
T11A410998B6F92108B3B77E5A9FF6A86D487ABC772F06945D10010E4F0A22F40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

4fcc412d-660d-4f7b-a023-3b420d9078fd.tmp

Path C:\Users\Admin\Downloads\4fcc412d-660d-4f7b-a023-3b420d9078fd.tmp
Size 7KB
SHA256 749495d347a6f86d2d50a61b9a90e4392836dd70681f24c0cda6c3b6ca18045e
MD5 67e9209b6d583d4e30e25ed0a9302434
SHA1 1064ea2619896bc90ea99cf6e15aa35e352deaec
SHA512 b1e8568e4b12d1599899aedf03fa7fd3cfff27cda1d2447a2642b3fcbae940747e3a6a6dfe5af1e7ef2eb68cfe3cefae8788b3b4c5025f539609887526e61ca8
SSDEEP 192:WMOBLBysD9r/ofiAYngGRR0qFZOHHVOKPBs:WBByspr/oiNnLS75m
TLSH
T188F1B0DE53BD17ED29292FA3D3AEC084449EAC74946854D485730E6D02F920663FBBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Free Fortnite.zip.crdownload

Path C:\Users\Admin\Downloads\Free Fortnite.zip.crdownload
Size 223KB
SHA256 278cbaa66307341d29047f8343ec025dedd7e59b4c08057b3471bc553ee51e0d
MD5 a3c3a88c42b8187825fc676b806ed2e8
SHA1 035e757b2a4d3266120560764e555236af5bb368
SHA512 fbf01f03596de67417cbf7405e7222ea24a8b0fea092be3346f4efdc17fd6ed43660b9386853d1f61bc1352e44eacc7ad310c437d6aa73fb13d3d76c4452ab5b
SSDEEP 6144:qSdrUUXdoq8iXzfm0pwRyTX0XkFHI84VjKVfv:JhxO0TX00FHIdVjKZ
TLSH
T1FF242362E5F8164E33C4083E3994E046DB953C7BE54C5406DEFE24A953A784E5FF520A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads