1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/11/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Saryx Free Fortnite.exe
Size 467KB
Sample261106-r89w8sys3q
SHA256 1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2
MD5 99c93db31fc7b6770f028739ff1b7a6b
SHA1 acb2a7eea2abda987d43ed0208ce040fcbdf325f
SHA512 f15b6133825d6040527cb36ca40336b37a32dd1613dec6a5e38abf3adf9c218865d02ab99a5a0f3fc871f68fe4b41452ecc76ebc7a408500d5439e6af45855a7
SSDEEP 6144:JM6AUQIB7TplUxP1VPlFHpCjnp5JAkauKyFFixFv6o0skhSqRtGLcxQfSz:WdxZqNAxL8oFv6o0pGL
TLSH
T121A47C16FAA904FAE1B6A474C8735507FA327C590720AADF23E0495A1F73FD09A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
6504	takeown.exe
6616	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6504	takeown.exe
6616	icacls.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	Saryx Free Fortnite.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	Saryx Free Fortnite.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_691331430\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_786499855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1988662009\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_691331430\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1619651421\_locales\si\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6372	cmd.exe
6900	cmd.exe
6172	cmd.exe
6232	cmd.exe
6728	cmd.exe
2848	cmd.exe
1620	cmd.exe
1152	cmd.exe
2428	cmd.exe
2588	cmd.exe
3500	cmd.exe
6236	cmd.exe
6556	cmd.exe
6124	cmd.exe
2184	cmd.exe
3100	cmd.exe
4888	cmd.exe
6308	cmd.exe
6588	cmd.exe
6968	cmd.exe
7044	cmd.exe
1132	cmd.exe
820	cmd.exe
5596	cmd.exe
4420	cmd.exe
7000	cmd.exe
6840	cmd.exe
1148	cmd.exe
4820	cmd.exe
3772	cmd.exe
6764	cmd.exe
6628	cmd.exe
6928	cmd.exe
5368	cmd.exe
5232	cmd.exe
6292	cmd.exe
6460	cmd.exe
6476	cmd.exe
6756	cmd.exe
6848	cmd.exe
6220	cmd.exe
6128	cmd.exe
1184	cmd.exe
2268	cmd.exe
6480	cmd.exe
6656	cmd.exe
6868	cmd.exe
2876	cmd.exe
4508	cmd.exe
1160	cmd.exe
1500	cmd.exe
1428	cmd.exe
5932	cmd.exe
7100	cmd.exe
5044	cmd.exe
1076	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Saryx Free Fortnite.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Saryx Free Fortnite.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6220	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
6396	taskkill.exe
6948	taskkill.exe
7068	taskkill.exe
5864	taskkill.exe
2268	taskkill.exe
1336	taskkill.exe
6500	taskkill.exe
6200	taskkill.exe
4100	taskkill.exe
6748	taskkill.exe
3552	taskkill.exe
1524	taskkill.exe
1332	taskkill.exe
2312	taskkill.exe
6692	taskkill.exe
6508	taskkill.exe
5648	taskkill.exe
2536	taskkill.exe
5384	taskkill.exe
2312	taskkill.exe
6788	taskkill.exe
6932	taskkill.exe
7116	taskkill.exe
6864	taskkill.exe
4944	taskkill.exe
5076	taskkill.exe
6672	taskkill.exe
6992	taskkill.exe
5148	taskkill.exe
4100	taskkill.exe
4944	taskkill.exe
2536	taskkill.exe
6268	taskkill.exe
6580	taskkill.exe
6312	taskkill.exe
5076	taskkill.exe
4672	taskkill.exe
6392	taskkill.exe
7020	taskkill.exe
6304	taskkill.exe
6644	taskkill.exe
6568	taskkill.exe
6836	taskkill.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{14473F58-FEAB-4CA8-9953-FCE24B9FC3E5}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	Saryx Free Fortnite.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
240	msedge.exe
240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	5148	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	5384	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	6268	taskkill.exe
Token: SeDebugPrivilege	6392	taskkill.exe
Token: SeDebugPrivilege	6500	taskkill.exe
Token: SeDebugPrivilege	6580	taskkill.exe
Token: SeDebugPrivilege	6692	taskkill.exe
Token: SeDebugPrivilege	6788	taskkill.exe
Token: SeDebugPrivilege	6932	taskkill.exe
Token: SeDebugPrivilege	7020	taskkill.exe
Token: SeDebugPrivilege	7116	taskkill.exe
Token: SeDebugPrivilege	6200	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	6312	taskkill.exe
Token: SeDebugPrivilege	6304	taskkill.exe
Token: SeDebugPrivilege	6396	taskkill.exe
Token: SeDebugPrivilege	6508	taskkill.exe
Token: SeDebugPrivilege	6644	taskkill.exe
Token: SeDebugPrivilege	6568	taskkill.exe
Token: SeDebugPrivilege	6748	taskkill.exe
Token: SeDebugPrivilege	6672	taskkill.exe
Token: SeDebugPrivilege	6864	taskkill.exe
Token: SeDebugPrivilege	6836	taskkill.exe
Token: SeDebugPrivilege	6948	taskkill.exe
Token: SeDebugPrivilege	6992	taskkill.exe
Token: SeDebugPrivilege	7068	taskkill.exe
Token: SeDebugPrivilege	3552	taskkill.exe
Token: SeTakeOwnershipPrivilege	6504	takeown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1148	3916	Saryx Free Fortnite.exe	91
PID 1148 wrote to memory of 4484	1148	cmd.exe	92
PID 3916 wrote to memory of 2848	3916	Saryx Free Fortnite.exe	93
PID 4484 wrote to memory of 4928	4484	msedge.exe	94
PID 2848 wrote to memory of 4496	2848	cmd.exe	129
PID 3916 wrote to memory of 1620	3916	Saryx Free Fortnite.exe	96
PID 4484 wrote to memory of 3480	4484	msedge.exe	97
PID 4484 wrote to memory of 1368	4484	msedge.exe	98
PID 4484 wrote to memory of 1368	4484	msedge.exe	98
PID 4484 wrote to memory of 1368	4484	msedge.exe	98
PID 4484 wrote to memory of 5748	4484	msedge.exe	99
PID 4484 wrote to memory of 5748	4484	msedge.exe	99
PID 4484 wrote to memory of 1684	4484	msedge.exe	101
PID 4484 wrote to memory of 1848	4484	msedge.exe	102
PID 4484 wrote to memory of 1684	4484	msedge.exe	101
PID 4484 wrote to memory of 1684	4484	msedge.exe	101
PID 4484 wrote to memory of 1848	4484	msedge.exe	102
PID 4484 wrote to memory of 1848	4484	msedge.exe	102
PID 4484 wrote to memory of 5244	4484	msedge.exe	103
PID 4484 wrote to memory of 5244	4484	msedge.exe	103
PID 4484 wrote to memory of 5244	4484	msedge.exe	103
PID 4484 wrote to memory of 4996	4484	msedge.exe	104
PID 4484 wrote to memory of 4996	4484	msedge.exe	104
PID 4484 wrote to memory of 4996	4484	msedge.exe	104
PID 4484 wrote to memory of 5132	4484	msedge.exe	105
PID 4484 wrote to memory of 5132	4484	msedge.exe	105
PID 4484 wrote to memory of 5132	4484	msedge.exe	105
PID 1620 wrote to memory of 2588	1620	cmd.exe	133
PID 4484 wrote to memory of 5804	4484	msedge.exe	107
PID 4484 wrote to memory of 5804	4484	msedge.exe	107
PID 4484 wrote to memory of 1704	4484	msedge.exe	108
PID 4484 wrote to memory of 1704	4484	msedge.exe	108
PID 4484 wrote to memory of 1704	4484	msedge.exe	108
PID 3916 wrote to memory of 1160	3916	Saryx Free Fortnite.exe	109
PID 1160 wrote to memory of 5776	1160	cmd.exe	180
PID 4484 wrote to memory of 5200	4484	msedge.exe	112
PID 4484 wrote to memory of 5200	4484	msedge.exe	112
PID 4484 wrote to memory of 5200	4484	msedge.exe	112
PID 3916 wrote to memory of 4820	3916	Saryx Free Fortnite.exe	113
PID 4820 wrote to memory of 6064	4820	cmd.exe	114
PID 4484 wrote to memory of 4736	4484	msedge.exe	115
PID 4484 wrote to memory of 4736	4484	msedge.exe	115
PID 4484 wrote to memory of 4736	4484	msedge.exe	115
PID 3916 wrote to memory of 5044	3916	Saryx Free Fortnite.exe	116
PID 4484 wrote to memory of 3048	4484	msedge.exe	117
PID 4484 wrote to memory of 3048	4484	msedge.exe	117
PID 4484 wrote to memory of 2736	4484	msedge.exe	118
PID 4484 wrote to memory of 2736	4484	msedge.exe	118
PID 5044 wrote to memory of 1236	5044	cmd.exe	119
PID 4484 wrote to memory of 3244	4484	msedge.exe	120
PID 4484 wrote to memory of 3244	4484	msedge.exe	120
PID 4484 wrote to memory of 3244	4484	msedge.exe	120
PID 3916 wrote to memory of 6124	3916	Saryx Free Fortnite.exe	121
PID 6124 wrote to memory of 4888	6124	cmd.exe	178
PID 4484 wrote to memory of 4656	4484	msedge.exe	123
PID 4484 wrote to memory of 4656	4484	msedge.exe	123
PID 4484 wrote to memory of 4656	4484	msedge.exe	123
PID 3916 wrote to memory of 1152	3916	Saryx Free Fortnite.exe	124
PID 1152 wrote to memory of 4212	1152	cmd.exe	125
PID 4484 wrote to memory of 1860	4484	msedge.exe	126
PID 4484 wrote to memory of 1860	4484	msedge.exe	126
PID 4484 wrote to memory of 1860	4484	msedge.exe	126
PID 3916 wrote to memory of 2428	3916	Saryx Free Fortnite.exe	127
PID 2428 wrote to memory of 1116	2428	cmd.exe	128

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6268	attrib.exe
6472	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Saryx Free Fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\Saryx Free Fortnite.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffd49aec188,0x7ffd49aec194,0x7ffd49aec1a0
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,7961592317688246178,17895491764231999531,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
      4⤵
      System Time Discovery
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,4435947279647112603,7026045170786389327,262144 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9156297826987848143,4911040032161188399,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,11201620315697761693,8499315465008346361,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14108004746534694243,13870953541671001511,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,243234098685698360,5194172526151740016,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,5861234475364790674,16037613293916769366,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4516,i,5702713882173511543,14510393449622005569,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,3015606930082400037,11317946026804268216,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5656,i,15956242696672156543,4218277034960684811,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5848,i,14721324258130467203,1864035724333138760,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6040,i,14656668553005214817,264388096911445526,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,3089844628832580032,16732378231985473290,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,975787490723113749,10443101150986857522,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6652,i,18278416981781635655,13191188095083229421,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6920,i,2899896939459352193,15842457565034673864,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6916,i,17358213523986564092,2037073037340411972,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7340,i,6408695482960310628,10612281880917790038,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7604,i,10346390172520240115,4851523843701635178,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,16487615220819422510,13109696065578893338,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7832,i,10670817337711600767,9222686740608667349,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,16487615220819422510,13109696065578893338,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8244,i,11949748644399888018,6233762189735305401,2097152 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:1
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,10123240813059739316,17835358132775534449,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,14133028944605260844,7627719141921448285,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8460,i,6247162258361129948,8812511847810038994,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8480,i,16587130582496007694,8550985786211448849,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:14
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,8219656116046453577,13285775927776315471,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:14
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,14085252043519800182,15228767020905972735,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:14
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,14796958837019000465,6973753180457685039,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:14
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,11489782107020353284,8851461542612311423,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:14
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16240320912534810767,14871491333586115602,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,17389548241005471354,13736721340519526552,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:14
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,782112959211953568,12407282333265399602,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6548,i,6508163595257067455,2717537685234564633,262144 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,16552534620973627750,17232225915464702244,524288 --field-trial-handle=2616,i,8021507945540350430,10680686812883167489,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
      4⤵
      PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1132
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4888
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6480
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6556
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7000
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6308
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\MyCheat" /f
  2⤵
  PID:6264
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4100
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
  2⤵
  PID:3604
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:5548
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:5776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6080
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
  2⤵
  - Views/modifies file attributes
  PID:6268
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
  2⤵
  - Views/modifies file attributes
  PID:6472
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:6504
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:6868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37b7b1a8-1398-4aeb-92fc-cfc4b09ed0b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37b7b1a8-1398-4aeb-92fc-cfc4b09ed0b4.tmp
Size 35KB
SHA256 a4eee9082498d971c5c0d6bc0af63b59392a0095cb6b97888bd46cc2e707b4e3
MD5 04e102bebd3e762c2ea087a10c3db2b4
SHA1 1d6f80aed3baa3af4233acac3f63db06344c92b4
SHA512 6f456a5d5db99094126d86bcd970ea91f4254ae2245e901dc0681be664c2a1e7a8fc2209c978fd2b503ba5b84c3b28606418b051d4ebcfa6b3eab284b241849f
SSDEEP 768:Jt3oNYgm14YLOYMDmGA5b65Q92RQMPbjZ75EDJL4:Jt3os0AF65dQUdGE
TLSH
T1E7F2AE71EC91DEB35DBA6680724776D6BFB85173C8C84A90D4EAAF0C04C368E134B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6048b1dc-8395-4aa1-881c-3818865d3ac5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6048b1dc-8395-4aa1-881c-3818865d3ac5.tmp
Size 40KB
SHA256 b0ebe2ff1482fa8c5b2eaf4b149bfbf0b5b9fe05ccb1264375d9828abef831a9
MD5 585c5d98fcaf791e14f08e4dc28f2873
SHA1 845bc6df03b98f00fc2813f90111671142b808c0
SHA512 2e34e00c691707c2233a52f5efba01845a80ed7e9a3c5b8b7e6c7bad50f8364a53c1a67523d12654645b1556b6ada49bb45b309ee4f0d39e59658b7a858af208
SSDEEP 768:Y/UxvxjgC+B35Z8gm14YLOYMDmGA5b65Q92RQMPbjCO:lZj3+B3500AF65dQUCO
TLSH
T1EA03BF35AC61EE7358FAA5803647B3DBBFB81573D4C589A444E9AF0D09D368E030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

5727522c-27c2-4533-b089-44051ee10f53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5727522c-27c2-4533-b089-44051ee10f53.tmp
Size 27KB
SHA256 666e1d8a351f96511e6b813fce2212b20ff45aeb8398c03cc2a03ab2ea4bc8e9
MD5 2a499903f9a1a5f507b503ddcd3dba45
SHA1 571298a5d0cc02d80b5d9a5ebeecf374797d215b
SHA512 49253b62c66ce8f82ae5ea2e78c19b3d353c1af6099671e16be7cd07019b9a342f658f12cddf3d3b5ed667d3a57e11e2ff28e1c635fd4e93a02d4d6d113ae933
SSDEEP 768:L7aa4W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOdNMdroHR:L7aa42Eb6DWgptfvDu1jatrMWx
TLSH
T1CEC2DB7B640CCB7F4F900ADDAC197E9B6D6802CB9698CD4047FE945C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

758727c8-c796-4fb0-b57f-96d5764101b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\758727c8-c796-4fb0-b57f-96d5764101b0.tmp
Size 12KB
SHA256 49d6e588af852c8658f46d2d6cdbb2bad6cf41a2efa06461e800b7a98d117d9f
MD5 eeb4dc350bcc18250fc9d6d2e96d02e3
SHA1 1e8e5905e4d23aa01a3e5deae038d5cb3d2e6eff
SHA512 9292b8d4e4bb49da089aa0c689b5ce404b0c80172aad1d679d26690c3031c928d865a2e64810aa1b1b721755cf03fb5ad4b799300ceae6df91ad6433dbae6e26
SSDEEP 192:sxR1RoCV/fs/skjsZ04zoA8pvj7/g6+WN9rhhY2US2cGqIgDwpHJ:sxR1BV/fs/ssS0BP/5ThISip
TLSH
T1FB42C919AD28A93B5CD7D20DFB657F97D2F9113290D05E48A6FC8A1C04F76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78f7586c-67ee-47a7-8160-0aaa303a1a2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78f7586c-67ee-47a7-8160-0aaa303a1a2f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

80bae171-9c50-446d-9c8b-5710b6d787da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80bae171-9c50-446d-9c8b-5710b6d787da.tmp
Size 11KB
SHA256 132eeb08c5db99e897b368945bc3cbd562a1189c695eced0428050a800fbab1c
MD5 e0a60da87df1da71cb8143ab9c4e1563
SHA1 a29b46da72938774cc34aecb986dfcfda369c111
SHA512 5542750e36d1d74dade965dc21ba7771fcca6e95aa8eabb7b27cfca615346aebe208483accc44fea69f3f2782689d2d35fbd73f034302e838ec8083fa5c32f35
SSDEEP 192:sxRSRoCV/fs/s7jyYh3zoA8pvj7/g6+WN9bLhY2GSccGqIgVvJ:sxRSBV/fs/s3beP/5phQS7
TLSH
T17E42C856AD28A93B5CD7D20DFB29BF53D2F95132A4D41E48A6FD8A1C04F76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 25da2903f9bd9052da4dedb84ce944a6f6508fc570d3394602a56fc24e638b3b
MD5 ef953386be1c179178e9941b943d0aba
SHA1 2d462a1dcbcc9f35e088cdcf17923cc6450ebf71
SHA512 7db26010244b3ce679f0282dba743f185e522f8e1688e5044558ecc4f4c04e2b5fe161d8ecc26aacc45504057e6fd5b085a4d353ece7eee9422cf80f10f50734
TLSH
T18EE0869816CACA3EA329A44B01F8B74CCBD0771BD7C56D4F1F04C8C67985554E6DB6A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ef8c23b15c08301a3d1d5f28d93f81d3c0786497e9978bf05a2892730d5a37a2
MD5 98738dc8c11ec0441c302780665f5cbb
SHA1 c8d45050bef71b91abe02e495dc43efca8af07b1
SHA512 633bf3208e8585c2754bd7bfd20054ddd8992e0b528dddcc51350cb4cfeade27327ac0d675ba9d5f40089271fc073c280cf19282d46eb16e176058b05c6043c8
TLSH
T15151D985CDE45250FB58023649D2F18B3EF8C9C1D7E79E0615BEC9FDDB2B798AA84104
MD5 SHA1 SHA512 TLSH

Submit Download

2ab1630c-6387-4ab1-8d6e-7bac565462cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2ab1630c-6387-4ab1-8d6e-7bac565462cc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

a069a6d5-d40e-422b-a05b-b24f7c605662.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a069a6d5-d40e-422b-a05b-b24f7c605662.tmp
Size 2KB
SHA256 c7c9aebaecc94f09256275340cd62728b03407f43f49f49a56ac2b7c027e0419
MD5 5bf9fb02edc3848cc85719d21b52fdbf
SHA1 ddcd07702ec9b0bb5e4d7eca804e2790e59dff20
SHA512 16f142381665d23f59e7dec1aaa2e1291fc6c324d30cc6229511c3c2199fc425d38e8f070b69d02355b3afa5b7c53a9df97797a616b678e728d5c99a75f0275f
TLSH
T1E041BDF383F4852E8A1196F0AB146E2FDE1C0915432C7C5A88E0AE2B93F3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

ade661d3-aaf0-4fef-89e3-9145bfd291b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ade661d3-aaf0-4fef-89e3-9145bfd291b0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b2e07733-92ae-4fdd-aed4-3300627cca86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2e07733-92ae-4fdd-aed4-3300627cca86.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 22707b020159adfecc8704c7823579f397bc215cdec40aced3da54006849a510
MD5 3d8cf2b9259fe5f2964afe38c3f49dff
SHA1 1f1e27da7b060af0ebc85c6816f8232574472daa
SHA512 5a15166e1662ea2d83436aa4d7157008e3d3e28ca929440cec94a819f4f95620cb614ecf91a7d2a22a578b565eaad9eaff3a29a15d8c56d2d667f4d2058c381c
SSDEEP 48:K0mBcAeEE9bI/wISY9K981+9xWtYXoEGyL5IVpz3Lkb3SPISBkK9B1rkxJ0YyzP0:K4NqKOg6iKkKfaYiQK3q2p
TLSH
T18F916002716B469039BD344882FAA61A468131B33459E53F7FBC48FB5E6AF184DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3245398-db42-4ea2-934c-85f8f3aa68e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3245398-db42-4ea2-934c-85f8f3aa68e7.tmp
Size 12KB
SHA256 9f4930b33c5fdb4721e3aef23407fd380b0d50970360a11c735b254427f581d9
MD5 3b1a28cf5f38ee4a7dd236f8366fc9f7
SHA1 95f3ddd2ef37a18a736a683e7bf679b8cde93b42
SHA512 2db565d775c6ccd33611a22e607835681aedec708e4a043e2e4ca4e98de59d3c94820ff44eb6728259c49024542965ed50d5c66cf38877d6860b9f4f203fbd37
SSDEEP 192:sxR1RoCV/fs/skwsZ04zoA8pvj7/g6+WN9rhhY2542cGqIgDCpHJ:sxR1BV/fs/sLS0BP/5ThdSQp
TLSH
T16A42D919AD28A93B5CD7E20DFB657F93D2F91132A0C01E48A6FC8A1C15F76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc0978a6-ba1a-48b4-a264-c066086ccf09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc0978a6-ba1a-48b4-a264-c066086ccf09.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a63bd83c-f66b-40cc-80e1-064407fea1ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a63bd83c-f66b-40cc-80e1-064407fea1ab.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0de5ad0-8d08-4315-b828-240c3348e543.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0de5ad0-8d08-4315-b828-240c3348e543.tmp
Size 35KB
SHA256 1fc6f07b6ce1207d4f24d0f2b54b57428e1822a0c82989002914b6e1413906d8
MD5 0af62f119557f5089b32c022cf1a2c5a
SHA1 a8e2ae5d1478e717f0e2a3d547e0c25f70b04a56
SHA512 803b13d2c3f754d56fe8da257f46bb7bf42d02c5c4ec6a47d59bee6913f9bc59d983fad3216b6e72591917c29514344512ce74613cd0d3036042f8b610060919
SSDEEP 768:yt3XNYgm14YLOYMDmGA5b65Q92RQMPbjZ75EDJL4:yt3Xs0AF65dQUdGE
TLSH
T100F2AE71EC91DEB35DBAA681724776D6BFB45173C8C84A90D4EAAF0C04C368E134B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5b19fc8-d5c5-4709-baeb-18f830594823.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5b19fc8-d5c5-4709-baeb-18f830594823.tmp
Size 40KB
SHA256 adb8c8b91b0e139fe3f0e9dee81113ffb7346bf5ae6f58fcfe2644cfb17f9758
MD5 d9084816238a45656bf9cbfef38c1c8e
SHA1 e51d5e741250376874e163da422f076aefaf0467
SHA512 a525fd87fd3789be9995b83f576718d1335cd6c11b83b49ffbdebdba3501c938aba62f3f2ca81669cc0d3522f7e4f439da83ef13f6608f069ef190f825997a98
SSDEEP 768:i/UxvxjgC+B3SVsgm14YLOYFDmGA5b65Q92RQMPqjFj05:nZj3+B3SQPAF65dQTFQ5
TLSH
T1B003BF35AC55EE739CF99280364BB3DAAFB901B3C4C489A488E56F0D098378D170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf971f99-509b-49f9-a8f3-6fa18d650b64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf971f99-509b-49f9-a8f3-6fa18d650b64.tmp
Size 39KB
SHA256 5534dd768e21e655c07f9548f5dd809b79ef86b7fe0dff1e17eb23fc2ce5000b
MD5 ed3497139766d40f6d2067b12333dc80
SHA1 9928e9fbecf934f3b25993d4bbaec1413cc2eab3
SHA512 249a4599ad29764450587a2fe9a57d9ccf3e9712db6b8aa64021a3008bfcd25c8e4b831388af1f133b65fefe58c3690d21dd2facaacb84411330c9931d2d94d5
SSDEEP 768:E/UxvxjgC+B37eygm14YLOYFDmGA5b65Q92RQMPqjFj0O:xZj3+B37PAF65dQTFQO
TLSH
T18303BF75EC55EE739CF95680364BB3DAAFB801B3C4C589A049F56E0D098378D170B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4787cd8b-4deb-45aa-a14a-4fc5aa4a9d2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4787cd8b-4deb-45aa-a14a-4fc5aa4a9d2e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

4f9a31bf-307e-4c50-a04b-42231412e99d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4f9a31bf-307e-4c50-a04b-42231412e99d.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d73e450f-38f6-485c-b23d-c8a95e18fab2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d73e450f-38f6-485c-b23d-c8a95e18fab2.tmp
Size 39KB
SHA256 732f7e0385479f9686e65831c075cfe11282e8c8a95abc54f3507f06e1013fab
MD5 be45f8e673bb87bb67109549a86a473f
SHA1 a79d33419c42650a9d13ee2e7d6f71ba4858b992
SHA512 da7997d8704fa163487f0721ebca115f5bf895963afcf304eb95646567d7e73e23e5aa6b712c1b67d8f40de6fa91ff0b338299b8a55f5c9deccd92f101fef3c0
SSDEEP 768:U/UxvxjgC+B3zOzwgm14YZtDmGA5b65Q92RQMPb9Fj0O:BZj3+B3iO3AF65dQeFQO
TLSH
T19F03C036EC91AEB39CF95680374BB35AAFF84173C1C895E049E96E1D06C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db35e205-906c-4e28-b642-23808105fc18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\db35e205-906c-4e28-b642-23808105fc18.tmp
Size 38KB
SHA256 2e16c0b1c7d49e2294dafbd4ea2ad2fbb38c2453a32fc79076fa0f9819e4d450
MD5 896dc2ba797fa3292fafdd9828fb421a
SHA1 7b7abb4dd2ee82f1bc27b5cf0d7857bf70c6649a
SHA512 48fc639453f0d2797722b41a615a5a8c5aeb48db2a0fa70ce97c67dd789e5fb66afebfe4eec742afdf6e6db0efe8563a1fb977db234dc38e9ac9c11f5e778f7d
SSDEEP 768:WFdo3dwgBNfGe14YLO8DmGA5b65Q92RQMPbjZ75EDJL4:mo3lpAF65dQUdGE
TLSH
T11C038D76EC91DE77ADF65781A746B68AAEE41173C8CC89D0D9D9AE0800C35CE034BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e77bf4b1-3b47-405b-8b09-bec2072780f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e77bf4b1-3b47-405b-8b09-bec2072780f7.tmp
Size 40KB
SHA256 8cca4a3057449bdf6bf77c560a26beaae6057a5da630318cb234798f683f7f88
MD5 787b3de8200b986c0d43a9f1cce80d54
SHA1 bcdb89220fd3af887a87891a7d1caa58157a479e
SHA512 dd2683754e327f9942af2770d1330369435b22eaa98473a44f78d1f51673ef2d0c6af5815fa78fa2083274462baafa10e69d3c530ab798fd09d8687b98fd8253
SSDEEP 768:E/UxvxjgC+B3oySgm14YLOYMDmGA5b65Q92RQMPbjdO:xZj3+B3ob0AF65dQUdO
TLSH
T19403BF35AC61EE7359F9A5803647B3DABFF8157394C489A484E9AF0D09C368E030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45b885c6-17ac-47b3-a3b8-373d0c0ae595.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\45b885c6-17ac-47b3-a3b8-373d0c0ae595.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

70938dde-56db-4de4-863c-9fd0d9e6ea92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\70938dde-56db-4de4-863c-9fd0d9e6ea92.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

87b2faa3-33f8-41f5-bab2-a22908a2a491.tmp

Path C:\Users\Admin\AppData\Local\Temp\87b2faa3-33f8-41f5-bab2-a22908a2a491.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d05e9df7-29b3-4efa-a9ef-4e1aca068638.tmp

Path C:\Users\Admin\AppData\Local\Temp\d05e9df7-29b3-4efa-a9ef-4e1aca068638.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4484_1253946850\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4484_2024418661\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_1988662009\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_691331430\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4484_786499855\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download