1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2

Analysis

user interaction
yes
max time kernel
102s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Saryx Free Fortnite.exe
Size 467KB
Sample261110-t1rf2agg42
SHA256 1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2
MD5 99c93db31fc7b6770f028739ff1b7a6b
SHA1 acb2a7eea2abda987d43ed0208ce040fcbdf325f
SHA512 f15b6133825d6040527cb36ca40336b37a32dd1613dec6a5e38abf3adf9c218865d02ab99a5a0f3fc871f68fe4b41452ecc76ebc7a408500d5439e6af45855a7
SSDEEP 6144:JM6AUQIB7TplUxP1VPlFHpCjnp5JAkauKyFFixFv6o0skhSqRtGLcxQfSz:WdxZqNAxL8oFv6o0pGL
TLSH
T121A47C16FAA904FAE1B6A474C8735507FA327C590720AADF23E0495A1F73FD09A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
199	5576	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
178	api.gofile.io
179	api.gofile.io
181	api.gofile.io

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5484_203385712\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5484_1216100423\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4996	cmd.exe
2320	cmd.exe
4316	cmd.exe
6920	cmd.exe
6384	cmd.exe
7148	cmd.exe
1356	cmd.exe
3612	cmd.exe
3200	cmd.exe
3216	cmd.exe
5972	cmd.exe
4572	cmd.exe
4528	cmd.exe
6984	cmd.exe
6476	cmd.exe
6284	cmd.exe
3020	cmd.exe
2560	cmd.exe
6668	cmd.exe
1912	cmd.exe
1248	cmd.exe
6616	cmd.exe
4240	cmd.exe
6764	cmd.exe
4116	cmd.exe
2528	cmd.exe
2696	cmd.exe
7048	cmd.exe
6368	cmd.exe
6788	cmd.exe
6204	cmd.exe
6388	cmd.exe
6348	cmd.exe
5296	cmd.exe
2128	cmd.exe
3424	cmd.exe
6068	cmd.exe
1744	cmd.exe
4072	cmd.exe
3532	cmd.exe
5004	cmd.exe
6400	cmd.exe
1908	cmd.exe
4616	cmd.exe
6076	cmd.exe
4980	cmd.exe
6744	cmd.exe
6808	cmd.exe
6472	cmd.exe
5796	cmd.exe
5464	cmd.exe
7156	cmd.exe
6964	cmd.exe
4444	cmd.exe
2748	cmd.exe
6296	cmd.exe
4704	cmd.exe
3964	cmd.exe
908	cmd.exe
6492	cmd.exe
1452	cmd.exe
2328	cmd.exe
5108	cmd.exe
2360	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Saryx Free Fortnite.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Saryx Free Fortnite.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3696	msedge.exe
5576	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
3832	taskkill.exe
7104	taskkill.exe
6392	taskkill.exe
6480	taskkill.exe
632	taskkill.exe
6224	taskkill.exe
5112	taskkill.exe
6828	taskkill.exe
2320	taskkill.exe
1716	taskkill.exe
3712	taskkill.exe
2888	taskkill.exe
6672	taskkill.exe
4528	taskkill.exe
5088	taskkill.exe
5820	taskkill.exe
2564	taskkill.exe
3304	taskkill.exe
6944	taskkill.exe
7008	taskkill.exe
6500	taskkill.exe
6856	taskkill.exe
1260	taskkill.exe
4688	taskkill.exe
2012	taskkill.exe
2320	taskkill.exe
4832	taskkill.exe
3304	taskkill.exe
4440	taskkill.exe
2948	taskkill.exe
2988	taskkill.exe
960	taskkill.exe
3704	taskkill.exe
2252	taskkill.exe
2672	taskkill.exe
4940	taskkill.exe
6792	taskkill.exe
4100	taskkill.exe
1744	taskkill.exe
6540	taskkill.exe
7060	taskkill.exe
6596	taskkill.exe
6540	taskkill.exe
4652	taskkill.exe
6668	taskkill.exe
4556	taskkill.exe
6064	taskkill.exe
3052	taskkill.exe
720	taskkill.exe
6236	taskkill.exe
6916	taskkill.exe
6800	taskkill.exe
6292	taskkill.exe
6468	taskkill.exe
6544	taskkill.exe
6660	taskkill.exe
2244	taskkill.exe
7100	taskkill.exe
1396	taskkill.exe
3908	taskkill.exe
4780	taskkill.exe
4824	taskkill.exe
1136	taskkill.exe
5192	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{0D34DB7A-D5A6-40A8-9BF1-AA114D667371}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{7334E37B-4411-47FE-866A-16244D0D3802}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	720	taskkill.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	6540	taskkill.exe
Token: SeDebugPrivilege	6668	taskkill.exe
Token: SeDebugPrivilege	6780	taskkill.exe
Token: SeDebugPrivilege	6880	taskkill.exe
Token: SeDebugPrivilege	6944	taskkill.exe
Token: SeDebugPrivilege	7008	taskkill.exe
Token: SeDebugPrivilege	7060	taskkill.exe
Token: SeDebugPrivilege	7104	taskkill.exe
Token: SeDebugPrivilege	6148	taskkill.exe
Token: SeDebugPrivilege	6236	taskkill.exe
Token: SeDebugPrivilege	6224	taskkill.exe
Token: SeDebugPrivilege	6424	taskkill.exe
Token: SeDebugPrivilege	6596	taskkill.exe
Token: SeDebugPrivilege	6500	taskkill.exe
Token: SeDebugPrivilege	6672	taskkill.exe
Token: SeDebugPrivilege	6916	taskkill.exe
Token: SeDebugPrivilege	7040	taskkill.exe
Token: SeDebugPrivilege	7100	taskkill.exe
Token: SeDebugPrivilege	6392	taskkill.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	6480	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	6540	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	6800	taskkill.exe
Token: SeDebugPrivilege	6792	taskkill.exe
Token: SeDebugPrivilege	6856	taskkill.exe
Token: SeDebugPrivilege	816	taskkill.exe
Token: SeDebugPrivilege	6868	taskkill.exe
Token: SeDebugPrivilege	6292	taskkill.exe
Token: SeDebugPrivilege	6468	taskkill.exe
Token: SeDebugPrivilege	6544	taskkill.exe
Token: SeDebugPrivilege	6828	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe
6736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 5464	6120	Saryx Free Fortnite.exe	90
PID 5464 wrote to memory of 5484	5464	cmd.exe	91
PID 6120 wrote to memory of 908	6120	Saryx Free Fortnite.exe	92
PID 5484 wrote to memory of 4708	5484	msedge.exe	93
PID 5484 wrote to memory of 4752	5484	msedge.exe	94
PID 5484 wrote to memory of 3696	5484	msedge.exe	96
PID 5484 wrote to memory of 4752	5484	msedge.exe	94
PID 5484 wrote to memory of 4752	5484	msedge.exe	94
PID 5484 wrote to memory of 3912	5484	msedge.exe	97
PID 5484 wrote to memory of 3912	5484	msedge.exe	97
PID 5484 wrote to memory of 4316	5484	msedge.exe	121
PID 5484 wrote to memory of 1516	5484	msedge.exe	99
PID 5484 wrote to memory of 4316	5484	msedge.exe	121
PID 5484 wrote to memory of 4316	5484	msedge.exe	121
PID 5484 wrote to memory of 1516	5484	msedge.exe	99
PID 5484 wrote to memory of 1516	5484	msedge.exe	99
PID 5484 wrote to memory of 4328	5484	msedge.exe	100
PID 5484 wrote to memory of 2624	5484	msedge.exe	101
PID 5484 wrote to memory of 4328	5484	msedge.exe	100
PID 5484 wrote to memory of 4328	5484	msedge.exe	100
PID 5484 wrote to memory of 2624	5484	msedge.exe	101
PID 5484 wrote to memory of 2624	5484	msedge.exe	101
PID 908 wrote to memory of 2388	908	cmd.exe	102
PID 5484 wrote to memory of 3244	5484	msedge.exe	103
PID 5484 wrote to memory of 3244	5484	msedge.exe	103
PID 5484 wrote to memory of 3244	5484	msedge.exe	103
PID 6120 wrote to memory of 3488	6120	Saryx Free Fortnite.exe	104
PID 5484 wrote to memory of 5884	5484	msedge.exe	105
PID 5484 wrote to memory of 5884	5484	msedge.exe	105
PID 3488 wrote to memory of 1084	3488	cmd.exe	106
PID 6120 wrote to memory of 6076	6120	Saryx Free Fortnite.exe	107
PID 5484 wrote to memory of 4840	5484	msedge.exe	108
PID 5484 wrote to memory of 4840	5484	msedge.exe	108
PID 5484 wrote to memory of 4840	5484	msedge.exe	108
PID 6076 wrote to memory of 2520	6076	cmd.exe	110
PID 5484 wrote to memory of 2868	5484	msedge.exe	111
PID 5484 wrote to memory of 2868	5484	msedge.exe	111
PID 5484 wrote to memory of 2868	5484	msedge.exe	111
PID 6120 wrote to memory of 3424	6120	Saryx Free Fortnite.exe	112
PID 3424 wrote to memory of 2080	3424	cmd.exe	113
PID 6120 wrote to memory of 4980	6120	Saryx Free Fortnite.exe	114
PID 5484 wrote to memory of 5688	5484	msedge.exe	115
PID 5484 wrote to memory of 5688	5484	msedge.exe	115
PID 5484 wrote to memory of 5688	5484	msedge.exe	115
PID 4980 wrote to memory of 2020	4980	cmd.exe	116
PID 5484 wrote to memory of 5268	5484	msedge.exe	117
PID 5484 wrote to memory of 5268	5484	msedge.exe	117
PID 5484 wrote to memory of 5268	5484	msedge.exe	117
PID 6120 wrote to memory of 6068	6120	Saryx Free Fortnite.exe	118
PID 6068 wrote to memory of 632	6068	cmd.exe	146
PID 5484 wrote to memory of 852	5484	msedge.exe	120
PID 5484 wrote to memory of 852	5484	msedge.exe	120
PID 5484 wrote to memory of 852	5484	msedge.exe	120
PID 6120 wrote to memory of 4316	6120	Saryx Free Fortnite.exe	121
PID 5484 wrote to memory of 2620	5484	msedge.exe	122
PID 5484 wrote to memory of 2620	5484	msedge.exe	122
PID 5484 wrote to memory of 5764	5484	msedge.exe	123
PID 5484 wrote to memory of 5764	5484	msedge.exe	123
PID 4316 wrote to memory of 3716	4316	cmd.exe	124
PID 5484 wrote to memory of 4660	5484	msedge.exe	125
PID 5484 wrote to memory of 4660	5484	msedge.exe	125
PID 5484 wrote to memory of 4660	5484	msedge.exe	125
PID 6120 wrote to memory of 5020	6120	Saryx Free Fortnite.exe	126
PID 5020 wrote to memory of 5396	5020	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Saryx Free Fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\Saryx Free Fortnite.exe" cmd/run
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7fff8cc8c188,0x7fff8cc8c194,0x7fff8cc8c1a0
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,1237310633655371606,8489595011582190738,262144 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,437616929356878041,2533088979618082187,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,12259227867832101968,5156142256202170982,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,9321001943085321967,7580856833320236256,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,2402522680703825126,4913431693854755075,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11302616668568633997,15655909091917521408,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,16722858532841945633,3522984671481733019,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5396,i,11795870588213990873,13376504710823147669,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,10008714473294039591,15162612220508888631,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5648,i,18153719279100094296,12257791025891567714,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5824,i,6873834645733481185,7323577752842357937,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6044,i,7494130976291852073,4417100207693312481,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6220,i,8892801497892052826,8335085214712180445,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6356,i,4969676954478924664,10189486249847183502,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14016934256577670073,1777069401421468707,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,5443372579771820033,8004866385945099312,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7056,i,12762504917053578035,11312279063593209041,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7336,i,7680856286743939435,11115214961014247029,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7376,i,6407597154392451585,13355489052975846092,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7720,i,2631632966070702634,8149122540730479675,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7608,i,14520236750290218888,3777958918817115171,2097152 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,11082556309874844933,13678475871851623328,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,11082556309874844933,13678475871851623328,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8388,i,14118809334654216868,14068124080242552028,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8556,i,8448645214316023675,16568067095732661875,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:14
      4⤵
      PID:6692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9008,i,16799795674434355819,1669318537675059923,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8912,i,3268442709647066127,11397770358362332266,524288 --field-trial-handle=2244,i,7168083020319196860,14234879910426398569,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:14
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7fff8cc8c188,0x7fff8cc8c194,0x7fff8cc8c1a0
        5⤵
        
        PID:2108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,5926395295105481696,13580471972480927981,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,7542090352445172387,475117760086765969,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
        5⤵
        
        PID:6924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,8944091140691097462,10435112412253300229,262144 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
        5⤵
        
        PID:7100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,12798684311794258424,14245815913039154209,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
        5⤵
        
        PID:4340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,12798684311794258424,14245815913039154209,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
        5⤵
        
        PID:1188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5056,i,3795703305176970200,13878766782315216956,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5060,i,11627979911942865467,3932695384684960997,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7844851411793315561,455485473218299496,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
        5⤵
        
        PID:4748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,8988388396920323999,197427153970624745,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
        5⤵
        
        PID:4824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4350688942329845476,10099079960211356090,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
        5⤵
        
        PID:3712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6244,i,11179931531736417473,2423228964680156281,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
        5⤵
        
        PID:4528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12991292949862080988,1617835933405294072,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
        5⤵
        
        PID:268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,12841829516467652396,7010728070242608,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
        5⤵
        
        PID:2856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4744053152202766154,7982846710383102188,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
        5⤵
        
        PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,2078035472337170379,1687307528658175158,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
        5⤵
        
        PID:4192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6311367116425239853,16013760096510017960,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
        5⤵
        
        PID:6768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,11556977790907455344,15664869421162371112,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
        5⤵
        
        PID:6616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6380,i,12636219363825431450,13918664601140356263,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
        5⤵
        
        PID:6420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7036,i,7990838222903432669,3059164862118604286,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
        5⤵
        
        PID:1336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6348,i,13733071171394054834,9469464494540482586,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
        5⤵
        
        PID:3496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7096,i,4913655093424003088,16930053089915155968,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
        5⤵
        
        PID:4648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,12056603653902435703,5647317600718265918,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,15502995733978412534,11408013108364068060,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:14
        5⤵
        
        PID:4820
    - - C:\Users\Admin\Downloads\Saryx Free Fortnite.exe
        
        "C:\Users\Admin\Downloads\Saryx Free Fortnite.exe"
        5⤵
        
        PID:3428
    - - C:\Users\Admin\Downloads\Saryx Free Fortnite.exe
        
        "C:\Users\Admin\Downloads\Saryx Free Fortnite.exe"
        5⤵
        
        PID:3808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
        6⤵
        
        PID:6392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
        7⤵
        
        PID:3256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
        6⤵
        
        PID:4148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
        7⤵
        
        PID:2068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
        6⤵
        Executes a command shell one-liner
        
        PID:4116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
        7⤵
        
        PID:2988
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
        6⤵
        Executes a command shell one-liner
        
        PID:2528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
        7⤵
        
        PID:6052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
        6⤵
        
        PID:2124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
        7⤵
        
        PID:5500
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
        6⤵
        
        PID:6700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
        7⤵
        
        PID:1548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
        6⤵
        
        PID:4960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
        7⤵
        
        PID:6100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
        6⤵
        Executes a command shell one-liner
        
        PID:3216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
        7⤵
        
        PID:5156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
        6⤵
        
        PID:3556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
        7⤵
        
        PID:676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
        6⤵
        Executes a command shell one-liner
        
        PID:2748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
        7⤵
        
        PID:2868
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
        6⤵
        Executes a command shell one-liner
        
        PID:6348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
        7⤵
        
        PID:3856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
        6⤵
        Executes a command shell one-liner
        
        PID:3612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
        7⤵
        
        PID:3732
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:6296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im gameoverlayui.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2320
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:5296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RadeonSoftware.exe /t
        7⤵
        
        PID:6616
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:3532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im AMDRSServ.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:5004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im amdow.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:6400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im AMDRSSrcExt.exe /t
        7⤵
        Kills process with taskkill
        
        PID:6660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
        6⤵
        
        PID:4188
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GamePanel.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4652
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:3020
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im bcastdvr.exe /t
        7⤵
        Kills process with taskkill
        
        PID:960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:5972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GameBarFTServer.exe /t
        7⤵
        Kills process with taskkill
        
        PID:6064
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:1452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RTSS.exe /t
        7⤵
        Kills process with taskkill
        
        PID:1396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:2328
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MSIAfterburner.exe /t
        7⤵
        Kills process with taskkill
        
        PID:1260
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:4572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Medal.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4824
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:4704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MedalEncoder.exe /t
        7⤵
        
        PID:4780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:1912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MServer.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2012
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
        6⤵
        
        PID:920
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im squirrel.exe /t
        7⤵
        Kills process with taskkill
        
        PID:3704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
        6⤵
        
        PID:1120
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im elevate.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2320
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:3200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im crashpad_handler.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
        6⤵
        
        PID:3372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im inject-helper32.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2244
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:4528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im inject-helper64.exe /t
        7⤵
        
        PID:2392
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
        6⤵
        
        PID:5560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ffmpeg.exe /t
        7⤵
        Kills process with taskkill
        
        PID:1716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:1248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ffprobe.exe /t
        7⤵
        Kills process with taskkill
        
        PID:3304
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:3964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mp4info.exe /t
        7⤵
        Kills process with taskkill
        
        PID:1136
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
        6⤵
        
        PID:5100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ThumbnailGenerator.exe /t
        7⤵
        Kills process with taskkill
        
        PID:3908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
        6⤵
        
        PID:4820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ICYMICreator.exe /t
        7⤵
        Kills process with taskkill
        
        PID:5192
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:2560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Overwolf.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:5108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfLauncher.exe /t
        7⤵
        Kills process with taskkill
        
        PID:3712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
        6⤵
        
        PID:6048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfBrowser.exe /t
        7⤵
        Kills process with taskkill
        
        PID:4780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
        6⤵
        
        PID:4260
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfHelper.exe /t
        7⤵
        Kills process with taskkill
        
        PID:3832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:4996
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfHelper64.exe /t
        7⤵
        Kills process with taskkill
        
        PID:5088
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:2320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ow-obs.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2888
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:6616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ow-overlay.exe /t
        7⤵
        Kills process with taskkill
        
        PID:5820
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:5796
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfUpdater.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2564
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:4240
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfCrashHandler.exe /t
        7⤵
        Kills process with taskkill
        
        PID:2252
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
        6⤵
        
        PID:6660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im OverwolfBenchmarking.exe /t
        7⤵
        Kills process with taskkill
        
        PID:3304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,5239298915655032185,8036437198851021806,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14
        5⤵
        
        PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7700,i,4545316688344771473,17204810068368053570,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
        5⤵
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7280,i,7135628410870577946,6016159078225424294,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
        5⤵
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7980,i,10708589533551531286,6427227901266267744,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
        5⤵
        
        PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8072,i,4612957856095248937,6760838531251065807,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
        5⤵
        
        PID:5892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8296,i,9172800517783459583,14885308295093714419,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8244,i,13248617132376117519,9529129536552857992,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:1
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8304,i,15231180000380779885,9265634221395751928,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
        5⤵
        
        PID:1836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8780,i,3781007728477968476,16573487804329636975,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:1
        5⤵
        
        PID:4112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8468,i,7701250268649643997,4104758273441555159,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9104,i,15528770594660199501,14546649602198260320,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:1
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9300,i,17704227401784225240,11408122112953839479,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:1
        5⤵
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9452,i,2815928088843171525,16668962229095786793,2097152 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=9484 /prefetch:1
        5⤵
        
        PID:1236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,12100478113834500119,10549427919942453686,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
        5⤵
        
        PID:5192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9340,i,11972765207658409169,3417208119298326950,524288 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:14
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5388,i,269078318926073444,18408924604326474685,262144 --field-trial-handle=2560,i,9434436437274376250,6872633627529532098,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:10
        5⤵
        
        PID:244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:3716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  PID:5648
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  PID:4576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  PID:2892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4072
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  PID:2736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  PID:6520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  PID:6636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  PID:6864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  PID:7092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7156
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  PID:6220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  PID:6196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6492
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:7148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  PID:2948
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  PID:6584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  PID:6596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6808
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  PID:6852
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  PID:6884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e0fe012-7795-4157-ad90-174ee2002fea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e0fe012-7795-4157-ad90-174ee2002fea.tmp
Size 37KB
SHA256 300e90eb29d5d53f2ee343af250d606a5b0540a3df6bd175fa5c22a339acfd92
MD5 13b8d3a7b931bc5ed726ddfe6617bc29
SHA1 f43364ebc9e9763656de3313e30352cdaf1d4ee6
SHA512 74d798e723971ed9379fefed1d059c8ff2d121a6b20fe75f19931da5413dcac6967424b6bdb24c0106669ff5bc2d4c0f3d2625d3e26077e0745b5218f3a8c54e
SSDEEP 768:R/UxvxjgC+W3NE1zc7fZrKfdp5XSwQs88uBkiTCg/P84g:kZj3+W3+itrOILNBdHg
TLSH
T12F03D039E8946873ACB39385375A275BAFF05093C0C41BA849EE7A1E02CB75D6307C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16d3117f-d839-40ed-894f-6f450c37c387.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16d3117f-d839-40ed-894f-6f450c37c387.tmp
Size 34KB
SHA256 e13d3558a3a0ec9d8e4b628464a4d5298324e18ecd8e43f4f765295e6d124acd
MD5 e9b8c12538cb5e908e27b9139566f23d
SHA1 190de29bff0cde11008b2d3f594aba904ad13b43
SHA512 632aacbd91ddb6c5f8c551176f156970b3ec32fcf2203aca8d99e3d1216119548199fa786d25feb53f6e30924e36421c3ab501fe7509b8df6125d4fdaaa2e85c
SSDEEP 768:eG3TsjPc7fZrKfKp5XSwQs88uBkiTlOQoaTZcaL/:eG3TsQtrLILNByQ9Tz
TLSH
T15FF2CF34E8969C339CBB9391735A3787AFF06147C8C40A98C9DAA51D01C735E3B8B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c0bbcaf-d5b9-4af8-bd29-45cecd2c0ade.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6c0bbcaf-d5b9-4af8-bd29-45cecd2c0ade.tmp
Size 34KB
SHA256 e95342c280589ecb8fa676823c32228cd6913d9ad430a53d629ee8ef52b6384b
MD5 14402266d50f7943c4d80fe8694d386c
SHA1 b9a17c4a5dbd53e8afe9788d34d4856457542967
SHA512 07bfc2a23891cab44fdbde7ac0aff5e084949a593b5dabc8c48a726543831bb317df3cad75f57dc975ee5942ce5d4d63e195d7965fc79b5baf416f91ae9a3b1a
SSDEEP 768:eP6swPc7fZrKfKp5XSwQs88uBkiTlOQoaTZcaL/:eP6sPtrLILNByQ9Tz
TLSH
T1BDF2CF34E8969C739CBB9391775A3787AFF06147C8C40A94C9DAA51D01C735E3B8B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a4e71e2-70bd-4203-ac49-71238885562b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a4e71e2-70bd-4203-ac49-71238885562b.tmp
Size 392B
SHA256 b1ed63797d8f93358ac607b43cab648bba6220c6db95dfd6e78f631fb787f92e
MD5 4aa683b3cce68e0df2067e0ab337fbc8
SHA1 d4c0907d117ad7aabae3eab31c86817025636f36
SHA512 5efa06985b257d413df13e7abb51887d0809e9398535faf3e0df504c28c50fa8f536e9ffc312b0e8878df177ffc2811e1571de90b5b91ffb766d1f48909cf3e1
TLSH
T151E00403971005CED0384B3400971F356AB380300262821A5FA251792C663492F20AD1
MD5 SHA1 SHA512 TLSH

Submit Download

7ad9c26f-3ef2-4b95-a20b-975d53253c17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ad9c26f-3ef2-4b95-a20b-975d53253c17.tmp
Size 38KB
SHA256 1fc3b615c505979f8d47226bb7b9b32d052b789a68fad896bd3dfbd323e0cc99
MD5 162b37bd65fbac7a49ec2326fff42df5
SHA1 b3cd52cc1f4804ba4996b161587ee4e1bed28fff
SHA512 387229b8dcd15cedb9ffdf00f01ef2f3d1227c2e985eb4ffb1d79738e8dd501218be47610bd5f25fd23b6262429703d893c2f41a3dee90fba3f255fd467b643e
SSDEEP 768:QM3ZsIPc7fZrKfup5XSwQs88uBkiT2Dr93loaTZc8Lr:QM3ZsntrHILNB41l913
TLSH
T100038D3DEC51583F8CBEB340260E26166EA4923BD4F405A8C7DA270DC1BB65DF783866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8edb7d3e-8bee-44f3-a792-d1643ce68af4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8edb7d3e-8bee-44f3-a792-d1643ce68af4.tmp
Size 34KB
SHA256 d11cc5aba6f521536a2efee654532f29009d1e09bceb74336d0acd49e0a81a8c
MD5 8a41da631df86fbf1445a7d71fc06468
SHA1 3ab2a049a6c0be6f1da9c980a0df4a6e8cfb2fc7
SHA512 0a3e5c462794d3120f3866229a23db00c3b33d26a546722497bba56cbcc3c6e53bf5115b91f8eb7a2ecc4b1bd151c11bf4a3c66ceeb068b96df4da60c4dc2b55
SSDEEP 768:PP6swPc7fZrKfKp5XSwQs88uBkiTlOQoaTZcaL/:PP6sPtrLILNByQ9Tz
TLSH
T102F2CF34E8969C339CBB9391775A3787AFF06147C8C40A94D9DAA61D01C735E3B8B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92036194-530d-4e5e-9dc2-a2383a546afe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\92036194-530d-4e5e-9dc2-a2383a546afe.tmp
Size 42KB
SHA256 8b19781a7d99f1fec62ad8148b91460c7558015129b32b1298df9cd07d8583ad
MD5 e5ded809182b479f0cf030a9a23937f3
SHA1 8998cccd50eb2c0ea37b2f5a94812915ae99fa47
SHA512 6937632d6661a1d6adf200b698e1ce65889144662f58e86f24954641dd11dbc1d0789167b5b3d4e3e46ab12de4929e42f9a0e5493266be7b5ac1600e921bdf95
SSDEEP 768:SFI8GwgHsYrAerKfAPp5XSwQs88uBkiTlOQoaTZcaL/:L8csar9RILNByQ9Tz
TLSH
T1511338F598D38937E8AE4383673D2E469EBCD147B8880994B7C95C1CCC862BFE746815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4376a697841a2a5dc871f77b5f0719b1d4a38c467bedfbd7d5dae536616547b1
MD5 40c596847315c42a85c89d5bbbf477c8
SHA1 3ac6dc372491b92e7a3e9815b3d40d0a27da2ff1
SHA512 42fede3ca69b61bd7a09b1c7b8746090d4216fa096f7b9fd744fb895cc2cb1c7634dfdbe97e27524e44009fd335dd7b3996ccf8309c471ea30a2bf4135e9e43c
TLSH
T1BFD08015792B7EBDD57F15F584D496442655DFA3DD10011515035C180B743821891DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3e7956a2e7cd41804b9e74c4ab542c920f50c83ea58e54a00309c30d35c626d7
MD5 f401c5073631424760f3be89bc9dff81
SHA1 3abd1cb1e018b48ab32fe131be55303f76ce2ed0
SHA512 2c9d234332edda531473b9962f5fa4e7ca31051e6df25be65b32ca4ffbdc3643593826fad840473ee7befec5ee4dae596ad6c74dde4d95ed97d4f2f7782d9882
TLSH
T157D0C02D730F3D1CCE0B14F318C083802201DF53CC01012124030C24066035908400F9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 660dde9648d9cbc663ffaf350c73807474c4a3bb0523f88929412da321686964
MD5 4969c596f7e83723c9c653f0274ceae8
SHA1 2befa34f3b2ca7cc580db6fd1e50d117dd7261cf
SHA512 b18e4b7104a087495f38765e813c4abb362166ce968087b65ae848987ca37b5ec289f8accbd048f6854c2b1d7ec3b1a7f36db7d71fecbd0ff4af44842670cc8d
TLSH
T10CD08029771F7D1DDE5B15F359D493946641DF578C05452124034D24066435919405E5
MD5 SHA1 SHA512 TLSH

Submit Download

12443243-3fe5-4653-9b0e-63fde3e828e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12443243-3fe5-4653-9b0e-63fde3e828e5.tmp
Size 14KB
SHA256 3aa1b1aa53c3e78aa7cb08f2984b832d2da65da24be9eede76f9e2568ee8cd21
MD5 04ffb4f68017b4b83c78628044104dce
SHA1 de3752cfeda4d633241416a00066a059db49e18c
SHA512 e2f782492d934f3aa61722ae9d350a03b0b1266914da9b3f42285d549bdbd06570b0b8ff80a5ce9e27cf36a5c74a4a51b3cabca7abb1cc37b6d76478dee2917f
SSDEEP 192:sxR5RXxd/fnsvWpV5flZVn4UKvThCEoA8pJd3H/g6+WN1uJ2ofshYMrT6GOIgVwp:sxR5Hd/fnsvWvpLtVKvYP/5/jhAWp
TLSH
T18F62FA45AD38A93B5CDBD329FA557F63D6FD1036A0915E08A6FC8A1C04E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c9c6607-e7a0-4584-b9c4-56b63f540a60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c9c6607-e7a0-4584-b9c4-56b63f540a60.tmp
Size 19KB
SHA256 0d6fb27760db0efa3870f2a858ad0e6df7872c27175a8a635aa006e2c104410a
MD5 48b31df642e39cf7382ec1a75e0dce0b
SHA1 b9164b2e596fd3e72391e2e720c9f112113f5c97
SHA512 a8f221be94cba63e6ceeea8674c5c90190ef6ad1e3296c177bbd0dd23126e30c3f0b18d8529de975b30df8f7e23f41059c1eaabf0ca3b19477412016a8ced9c8
SSDEEP 384:sxR5ld/fnsvWviLtVKv1C5I/5EOKHFLhKUeyNyBT:stld/fmYixdI/5EOKrKUYBT
TLSH
T16792D846A924D8778CCBD629BE35BF26D7F914269C914E4C6AFCC91C04DB6FD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ba4ba3a-afdc-44dc-ad78-58b2f9658e82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3ba4ba3a-afdc-44dc-ad78-58b2f9658e82.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96a41ce9-dcc3-4815-ae97-8256be423145.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96a41ce9-dcc3-4815-ae97-8256be423145.tmp
Size 13KB
SHA256 60e5a1f45611e796d6ca5ff2f93b428d2ac7c82512345201713c6b69ccca0fd7
MD5 312edd7e59db46fbe5d07994c4dcac5c
SHA1 6debdb57aae6b530273e55592d0ff22f6f97e851
SHA512 b408b97eea80ae750bb368c2fde6c79911f2db1878d4a1ee07087aec9e05c806e3df0a25d346f91741513c6f242be208b178b4cbd6f34fb62a36e6faff89bc32
SSDEEP 192:sxR5RXCd/fns+WpV5ZlZVn4GhzoA8pv3H/g6+WN1kfshYMpTPgOIgVwHJ:sxR5cd/fns+WvnLtOP/5Bh9Wp
TLSH
T1B352C755AD38A93B4CCBD31DFA55BF23D6FD5036A0915E08A6FC8A1C04E7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d82ca53-566e-47d6-8d72-c6edfb2c73e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d82ca53-566e-47d6-8d72-c6edfb2c73e8.tmp
Size 414B
SHA256 3702cc24aea721d3e992949a27f3700623c30abf3a1ecb04d615e24ada6e0429
MD5 c91263342de447e2bf8662de87aa5f7f
SHA1 46e8901160bcb0a649dddf5f53b42d65a52447e5
SHA512 8de065abf9a314af980927c74eab99732d47397dd41641b3b32ff5ac9574b73a8b92d815cbb7226868831755ef3920022e4cfee8de2c79c2e8d0ab75753ff835
TLSH
T1BAE02BFFC921EC3718FD07181454564DE764130A2A81894F7A7C910CCFF1B2A419696C
MD5 SHA1 SHA512 TLSH

Submit Download

9da57b3c-522b-4127-8fca-8417c4c2dc4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9da57b3c-522b-4127-8fca-8417c4c2dc4d.tmp
Size 29KB
SHA256 3f8aa221ab20074702cbd7f37260c35d19a1538ed1ef892db205cfdff01fb9a6
MD5 c8342bea9a22d4fe1b9431ac4dc1916c
SHA1 73ab13af6574d69f567243d79027d60b64d831b1
SHA512 3b3ec6a2c366b42be20003d905ed2a18adc30bd234b7aac0ae1776230c30ac034b985ef6eeaa5fe3ec8df581f9d4bce9e5673f40a8f90e10d32f79d070a5b7ee
SSDEEP 768:U/pCzb7pLuLjJmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQ0NyhpHroJe:U/pCztEjJmWg8KfrLu1jaD0N8pUQ
TLSH
T108D2C97B740CCB7F4F804ADDA8197A9B6DA902CB9698CD4047FE941C02C77EB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 34eb42f228517451e40166ce37a3b04def1f96406857533e2367d818dac8de10
MD5 73962a8c8112d20551bfe0ea6ec6ae2b
SHA1 e378c6c8c6457da4a4f5971bf0d371f1f97c761b
SHA512 0718ed897e6823cc521075a5c053637015946f65f30a5198b2e69a386e5081b5e4e7fe7c1284da405e9debb0fb8047ab140f6682415ceb2508eb18b286b08e00
SSDEEP 192:U4RKqv/nQa1Ic7Ep16kBJkhFm3LB/iZVrDBZCY+rT9bjl6:NKCvrgp/CVvHB2BV
TLSH
T193131B3CA7B62E26F6D31C7D3163AB79A7F18039DAC552235531FAB8A7447015C1E832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 54850d9b2ecca7ffcb3b53a29075c8eb077d4d95c85762d574033c834cb8df23
MD5 29a8d9048c0ca245d61ebd642ed7106d
SHA1 88e36f5b6ea3434219bca4c8e01c90dde5596e66
SHA512 7c68b43cd4199a048139beac38c8eec3ad6ccc874ee9dfa0bd02e024554b05201561eb826b8a54f71581cc7aa9a93a17073443368c99e9b0842cc9b23bebfd31
SSDEEP 768:2OWIN8x+L/8dGL/d11n0Fbc6Hm53+QzMwF/SgQK:2OFL/8sL/d1duQzLS
TLSH
T129443EFB1A21A01ADBA852F6D6033E3ED1B7015E6CD1F899D17C9C812925F31B2BCE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000039
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003a
Size 24KB
SHA256 7e170ea7f2ac873c595b9f72cf35b8c15af17b5bfd3488b101bb5aca034d07cf
MD5 85cec2f36640165630285fcfde07831a
SHA1 680a959b7128688ec8201e5af72ab129474f7b4d
SHA512 74167696ce9516f43be0bc2a75524910e3193ae47ff75ffc339c33eb68594c09873099966a22701ec66978b5e7cfc372e257065387c0619860acfaab0da53170
SSDEEP 768:n/FWnQ1G+lImP9UJSz5TeKFMI6Nc+n820:qQ13IuSJSzFeKtU820
TLSH
T1F0B2E1346D581B27F1D251B57AE48EE8E1A31A05B4521E653F8E02002EC13EFE2E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003b
Size 102KB
SHA256 b3872b22bbd31a251930d167d0a58d2e7caa8f81e6d9dcd636b01ac4f2ac8982
MD5 226c9c614d3cb21262ce545da7f7fdd5
SHA1 b9d89307d468aa84d23a67b94549e02a657c379c
SHA512 e6dc257f0a0ac0c9c33836729d79300bd6290edb6cef9864240aa6c7aa468e48b2be1aac0dfb466b21df5515689f125cd06516a50966292d3ea03226de771cba
SSDEEP 3072:67SvKCy+OUdKhsh2Yx/A5g/cEaqUBgCkRd:SSvKoO8KhepiEyZ6Rd
TLSH
T12AA31298BD47B9EE2402744D30211265B207D92F1DBC05F24EF790D61AA9956EAFFC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 256KB
SHA256 20368095d8a4349dd55161aba35d963fe65274e2775bf5241879c59a4fd1fec8
MD5 d83cf7856de0bb4e2569e929d109b995
SHA1 6fd4694a9b838f00e1acfd83c0c9081850ba6ef7
SHA512 45037f87264832fa82d9b1271a049b89c264063a5a9ca0c03ffab3a98ee4f902bb83eb117e31a275807787d8c6108192d9a190de94ca7c5c707a7e7c1ff091d5
SSDEEP 6144:DXvv2FuTL3JjqRwu6RCbulUX8CKe7gFRmyUYXu:DHXMuudukhKeCR9Ru
TLSH
T1A644238CC6F8F2B131658B021BB0B01E1F863977577EAF5EA93675F08B29581EB11C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 20KB
SHA256 fab436a127c29499e0ddbe96f33c5547b050fd49092ceaf6bad0dc1e04b36935
MD5 64d0df3dbc368144bc339f4b10141fe2
SHA1 8071f9d63f207f838ffe5521afaaa7406bf7a3b6
SHA512 4df86d13bb0d38cd3934d46b6ebb2b657c75146281524c1e94797e3aaf11c6ec05b95d19bba4cf8e5771b17774bc29bf73c44949a9980c1e09f21703754dfbcf
SSDEEP 384:501QE3bbzD7K6FGrRmOGEuKIbZb91uMqy11sPV2gERykhv2BRiWi9hrwc45BztKt:8QE3XzPrUR5GdZI3yqV2gERlvORzYMcN
TLSH
T16F92D0672DA34B6B0821302AFF816B65AA2D23419D37975775F4F5E8C8028F21A39B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 16KB
SHA256 337e833eeec5d082813ced903aa54622827f234f3dede039ff9214db457f1fd5
MD5 791aad127c501fa802bad7abfaa10c89
SHA1 6618a6123fd22e3662783402d1a4c49b26805a7a
SHA512 9b8f62e7a98e8d20b8b274c0f7cc06704717573e155c512cd2e3ae8bc0ba70fb8ed954663793c1319b2d1cdb18cc5da49aae6ea964b406b716795fd2006cfdbc
SSDEEP 384:CMGpcjgv7iP40u0b9DCTxP+OS/lkxUx3jBSsP0B6kp9P:C/pcUv7iPZdRkexzcscV9P
TLSH
T1B272C0B2499CF9581C2BF95A5A5F1ACF551CB087091C52E380264CE87E43D02F5B6EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 36KB
SHA256 daee2012cf5e38a54053ea9bb33e687e6a7fbf1199f6681ef2180fcabacbae97
MD5 cb7a34ac7ceff3a8b7db2a7f6f3d0dcb
SHA1 d443b1e502203af3a284c2f3522cc58303ef7641
SHA512 ea974f26061d62eb6d9a0d4ec21bf31529e44af8794f5d5f403c618c6b061eed3fb8416addeb1aaf641027bd8daa73c89f30865fae4b3977936bd4b87dd66e7a
SSDEEP 768:3tI9ZSixT8lI1JibnWYt+Q6eUIHEXhUPWUR26COqR3MOh1u+r8RBzms96:3inS0aWY4peUIHERCR2JOqhNhg+rN
TLSH
T148F2F1B92D28510FB8CFF4B6D398C4C069BBC53307257A5CE6E6B847DAB464440BC3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 40KB
SHA256 a852afa1267e2bd6c5164eeea43fbedbe27208e1fb9b66835e422cc55714d59f
MD5 b9615c928956537ee3b6f608e7c0662d
SHA1 4354ac6b09167e2660fd9f2179182a08032b8e90
SHA512 31b50db77df2ffe54eb1d55c9f18c0ece2c7d8c213d58ac736cd1bcc1508ffeae759e4f3a5ebe576d21c8cac8bef02c4a53ed06f8fe7ac3e5b63c42a3ffdecfb
SSDEEP 768:EVJ+MnHjFDPvEwYz/zAZQJJ6kr+2Oh9whxVP9t3DnbgcWUBC:E2MHx7MhsWJbyx+3tTncc7c
TLSH
T13913F12BF02CCAFD14F1B98D55400B8C74284CA96DDB137F8EAF091E17F541A4A2A5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 ba7b4b292dce27cd5e17649150ec62ba28cef85233a76efdde73894ee00f91b3
MD5 0dd0f07500b6d941afb5cdd03f51b9af
SHA1 8e61c1d8502b822be799d906449a53aee00a3046
SHA512 d64fd88508eb9274313f4dd470dc98d9dd113b53448dc121c4cbcff841531a3d5be6511ca8b72f08c4b9b64c1d05217b1cecdde36b8a95cbb638f4424d7b8566
SSDEEP 96:ryiBIP6qImVVVAgmoW8aAb/ad5Fa15e8HuTRv1p/4/QAAQkmhrsKQiaLb6jx8EW7:GOKVIMJOFYXsKHVY4zC
TLSH
T1FDB177D2D3BC1079EF5CD17CA0E43B9735B7C4789B672F430455C57C9B0AB92A22A0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 275dbcd71197b98c6701d528aeedf837cffd6ddb2731c1f7b1cc12a01514bf41
MD5 b9783f6eab0c8ddf2eaa1b1587bc3109
SHA1 00af0f6602e83de5695b3456f85f3044929fd370
SHA512 78f07f5c913659b84a2b49c891d966f60b823580f94638cf03a341a129dcac74c0803fee3e83cac9ca80793aae2d65082d62cd23f4e7b35e0e5a929f3c264b45
TLSH
T1DD5153D0C7704126EB59C1B5A4F4278736F4C9BC6F8B1E9215A8C5758F4235783280EE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 82bdbbdbc4522f53abc90d4e927addfdff07f1c1d62900ca091562438ab4dae8
MD5 bef6422f44df71cbd3ae6ea26b9ce539
SHA1 99e8b684d067dcd4d1e12a89c16f6060c959bc62
SHA512 5e134a9f1df8da36d7ff89e275785c49b4519bc0dc5cad9768570d40f4fe7c2e6eaa7d2c5e83b6ce5ddd0708f6a1d7035e2024f7e6b1f5af570d6ba49bfcf219
TLSH
T1F25153D0C7704166E759C1B4A4F4238736F4C9BCAF8B1E9214A8C5759F4235783280EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b736d7db59751ff02b6b04b61c9be9cf6b9c46de369a272c2a3322e016e7911
MD5 56e6874dcc96e4fe2f128632090b0b2e
SHA1 76ba34490e1cc4023d90b47e6f4f5130b97afe79
SHA512 29f8f2551ebc6adafcbcccef71c2ef49785106bfa2589cd921e246ee6bbb8fcfbe787fdaf3adfdd0b408d04eee33f5fcfaed04c34401defcbe6250ceb03c0dec
TLSH
T157818595C7BC5155EF88D1B4A0F12E8736F6C4B8AF872F430458C974AB43392C62A0EE
MD5 SHA1 SHA512 TLSH

Submit Download

78dc668c-2e3a-45ce-9a1b-ebeb5cbecd7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\78dc668c-2e3a-45ce-9a1b-ebeb5cbecd7e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 caf6837b5e923b86705b7a8314d5e02036e04320d8d49e5f311442e6a9fd4ac8
MD5 36bf50c15c23470a44a3947775cd0439
SHA1 6966f114c19704ae367941904fced0c66d547228
SHA512 45e708951d2bddc576b8e911a1fc69be18cbd60625da8766b846d5919fd03cde86d5553ea0949c8d88acd89ab7e4d97f20f19b7d08c57bd118b69027953da272
TLSH
T10AE0865836DBC52BD12869D343F8B70987D13596A788B9061B49CC996102749E7AA280
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 772ee8799f9f809707acc272b003b9406f2783312b0bdf8ed0f53918e8cd6f44
MD5 465e1925593583f5948bf7082b494be3
SHA1 2dade09947938b2dab4de11c2e55462e426aabb0
SHA512 aad1d8b868046db5d03c1df6e127a0c41b56568a54e0f7611b052f7f1fbb49fe9b306746f9e24fec634b9420f07faa4ebfaf0e350d063aa963a40a009ffc9fa7
SSDEEP 192:WLexH+bF+UI3iWGVoWN3qL/MliKk4LPPXVVV63:xIkUI3ijVoWN3qL/0iKk4LPPXA
TLSH
T1DD24635F1F203761CDBD413A19E655A35CBDF03FC70365EA787214A5CEE3652A02C8AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 7b5f737041981173d6ff603f5370884a76c24431e5d9f085d6dbbac0cf14a529
MD5 84c29e045f4f93f60ecac3ce7cf7f9a1
SHA1 9d5f877ea99eb43df1d7240e1e97c3ddc21c4c9f
SHA512 27f66c55b39ea98154cc485307a5601ac0fad54a09fe7c6cb3587e4355f38cb964920fd2ce44f7fd59b0fd5428c7cc162c805a0d36a797cce055b3747a474061
TLSH
T167E0D8A976DEC529A328218B02BC7708C7E12676D7897B451B04D881B14220CA7925C1
MD5 SHA1 SHA512 TLSH

Submit Download

4f7d3054-d5d8-4ea8-b578-f721d1db01d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f7d3054-d5d8-4ea8-b578-f721d1db01d9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

77f7be35-89e3-440e-a2de-87e502f22369.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\77f7be35-89e3-440e-a2de-87e502f22369.tmp
Size 2KB
SHA256 100f7a4c56feca266c5151cc673b071951fa40d5ba87480a9a97e36458c0ef48
MD5 346310ac4656562a63dbb6d467dc6285
SHA1 01205aa71e9ee03609fa49bd2a6ba63cd88e0b6d
SHA512 30252e49ba1879672a13103425f3218d49e680340aa5b4825182d11028606a155ab2dee6f93add8c11ab3bf3725bb9b39acd66980135801dca19a85f043185f2
TLSH
T1A841AEF3C3F8856D8A1195F4AB146E1FCE1D0915432C7C5A88E49E2B93F3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

9ffbf0a5-9ac4-4761-bde2-6fe42ea39c3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ffbf0a5-9ac4-4761-bde2-6fe42ea39c3d.tmp
Size 4KB
SHA256 f11e1aa3af6e1b7d49ad90324d7654c5457ac8ce944b238d0b7b738ed78e5967
MD5 89cc47e6dab2bf4813016c381000c760
SHA1 3a55b883795f441211699241b59ab0c66d5626e4
SHA512 cffdd9af5ca704c7692f38f88b53a70e2c79261c7a0fa55b17f7a07dcc39b92e63a64dbc12199244bd46bdc3c5a33aea3260c332a571aa12a85f06ee4ecffadc
SSDEEP 96:DfO1QRiVaZjhr+czFZRsiP0BGO5cwGHUtILztwXx:D21QRiVaZjhKc/miI75cwG0tILzt6x
TLSH
T19FA199F383F5822DDA1195F0AA186F1FCE1D0556436C385A89E4AF1BA3F2471E181B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 cd97bee65b453649e2a1981c525e63446f325fdd12c3ea0074295adeed388e1c
MD5 5b20cc5aee65c55a97a3d3d90c848835
SHA1 25acf9d45a1ca294cca51d9318fe88155aa0908d
SHA512 30a2342542aef0052935e17c7355a363ed1ba13adc31a5a99929b6ec7f1dfe85fdc6b259792fa7999e7ba105c516cc2958623ff7ecff9faf622ac2ce922f851e
SSDEEP 48:Txk/LopFMaty423w/a9NUuTxtwA+o0ytwP/FrlE:qDeMatha93tftON2
TLSH
T15AB2204D6F302161C1F05B36EED548662F7C211ED7A36649D94450F2CDA366BF5060B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd765c5e-54e9-4c17-86fe-d519f068f6ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd765c5e-54e9-4c17-86fe-d519f068f6ae.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\122a98f3-c06a-410c-89dd-149bc550b848\index-dir\temp-index
Size 2KB
SHA256 002de73b7fc1b886b0df5ab24f7806a4829c6f1f5052a1bc57d25f954e947b64
MD5 99550c07d772524cefe43e66f8f76fb4
SHA1 9c5126b338d3a84d31ea76560702206376979253
SHA512 88b6b2c700edbad3b3c5ff798c32969fa6705be4d5845f239e7e9d36f251fba48273d2557af3ab1558b983eefc66e8be52c0aceb6dd7ac2628e70369dda114bf
TLSH
T13351B4CE9C0D7AACC42C0AF239F90942237E5DED5E9A9D4356EE4231A8C30BD1D0A259
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\122a98f3-c06a-410c-89dd-149bc550b848\index-dir\the-real-index
Size 48B
SHA256 d3740c7bc6804cabda2a944016ee31966ab7ffc351b9c7f3112b1e4f25f520bb
MD5 bea467425dfbd3cf4aa0044b4fe44d4a
SHA1 86da6a0c7785ba023055cfb332b0bb9e7d379e5f
SHA512 135655e9ca4f4193376af11ae2a82200dca202fe85a99133ff769b6e9bd1e4a67d23a7072cc4b7f8202dfcf100b135388b5980c00ebffdb06b02fa997af57a5b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5c1e2d59-d94c-4d64-8767-7acd836a5f09\index-dir\temp-index
Size 360B
SHA256 a5f1fddee87d6dad6354a049823045adb83bd5ea1aab39679696a1e5d8c79755
MD5 c7deb948841ecd28e127c214a9c3b976
SHA1 3298bf6306eda5c37bf27ec4f17cfeb0421669ba
SHA512 985d3da464b925f563d5a84ae82d590515ee5ab52a7fadb642a30dd0620208f68f82288c063c9dd6f9ae1f0c65911c6b8457dd8197b3f84b113537152ef439d0
TLSH
T11FE02B993E2351CBFD54407A743E9062573114EC9314160B34FEB0568D0B784BF83A18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5c1e2d59-d94c-4d64-8767-7acd836a5f09\index-dir\the-real-index
Size 360B
SHA256 3d03128e328dc9be83d93df8a9d9abd81338b0d3008a8e5a397f9b05aa16addf
MD5 b6cf1403d285b80cea5b986c2aa02f7c
SHA1 28accb1e15abcd5f2ee4ea68dcc7927c3a5b9894
SHA512 21e23d6488def380e516079c40eae0e8f4e7f55b50b215ef2aee1fe9e727d6ecfbd68dba5006b7a8dbccd1ee1ab83032a76fb85d8fc2ba17f7e091cdb6bac6ad
TLSH
T157E095590723D246F84C0031347E61316671145CE320370F61FF9056CC87B446E02F14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 484B
SHA256 f4fa336bb9c52efbfd40d6ec5aad24f3af44c74bed16b74c9ae8cbba406ebeb8
MD5 84a77ca2a19006991d0450dd7d45c415
SHA1 5bb4b46a48d3ac86cf8ee7f53ce3bb7d5ceadb5d
SHA512 de6d295bb8d5dfce5743c8c1b37f8363dafdaabc0f3e600ce471f05c491ae510b403c9beab311c54d6365661a35b51a5b5cb49143bec15c08b30ca8226ee2d92
TLSH
T18DF0E2B73DF66814BD9BD3E9643150660142B959C604EC4F103A679340B23A62049CAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 4bcb62a55c535444175276650cbaf6c288c254eb83e44e0a53e3aa35e72ce6b6
MD5 5008fc71f8a4298e3958270b50a33eda
SHA1 c4b8faadf47ca011223b0f8b9b5f491d321993a5
SHA512 857727c70b2a8a181c47ae2745fdbce8b408516e771acf6d2d5db9766d67ce451cc430d421e517a986b5ace6a87d3926ae23d1b339dd1630093c59c83fcd3e34
TLSH
T119F027F73DF76804FD9FD3EA643150AA0142BC59CA04EC4F503B779340B23A62049C6A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 45ac029bc9f1ab211aa3e5b9cd76c901fab91ae8a73cd2fae8072576a2d482e0
MD5 1c38d4b4b4d93a0eb3863bee03117d0e
SHA1 8c470c2bdc36a858619293a52928feb2c930d4fe
SHA512 574f35789b454d7f5a527897528f632a065acc0529e326461737d27c3544919b6eb76530577371458ab1fd3785dbb5dcd0dfb6949291315e783610a4c10451af
TLSH
T191E0261467CAC93DA229338342B8930CC2E47467D3C8BD863F80C8A06542B08F2A2680
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 cd03b147be445f55b24cc9b66ef28adc88116eeef6583d72e9a4354ebcdfd329
MD5 f17ef0aeb05d907b152242baa52fa3c8
SHA1 78c5908fb1b28fd821bff330f7ae29c1dac9442b
SHA512 b53bc5e1ca1aaca70e5c34308754683a440b9ac7dbf5dbe0fd705331606dd45acf4a5f1f916ccaf23933902f51df81da876eb5c60cc9b7562b30d59eb527135d
TLSH
T1A1A00290014D101FCA10067122856FE433AD58550585134265E19499BC9A240D383509
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 f397964bed01da15b74ba19eb0ddf86d4b0459ec6cc92e511ed252be928f78ff
MD5 bbff255a59baa74deb62f9376a41c7e5
SHA1 c142bf017790592874fdca26dcb24e61341ea24f
SHA512 23f21883e90009fcbfbf0698597b00f52258850a99aae4feb09f1eb800b2cecc6d675588caa3b7b4c47025c77a9ee4911613f6dca9f71cef089da5d99143de1d
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c5ef0f79e63b659faa9e00b58ed10dce1efec11992818d68fd1db766ae6d36c9
MD5 e824d3b2617daef67da6ab98487abee4
SHA1 adaf89b9fc67647cb1b671a2ba630e4cf5a10a9d
SHA512 545775c78bff27426d7da5db376aa448ca0d814b9890cd921613f235f8cf86351afcc0c3ab49c9331225bf7f434d8134a9aa794304c037e996db3a6134edf915
TLSH
T1DDB012CDB300A187C94E1B39074047C527C0F00304502207686C8E76DC50B7CB9030A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 a839a28a27af2b0387204be454fdd3db715fb96cb3733f14cfb87fff9d0244a0
MD5 165fb7afaf47be06361d997e89a44b43
SHA1 774ba50b7519afde2f0c0b73b751639b028fa5fb
SHA512 c22497a7dbe25dba474a35dfb8050ce427c018d348bef0ae7d5cb2b15fe001d59e898a9806fe6ad0e082bd2dccd18eeac0e396ef8b5f491d9cfe2165b92c6711
TLSH
T15CE020343BCAC72FA35A71C70279F30CC2E27452E7C9A9552F08D5D0A2067447353D40
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 eeab2fd24e9f73cad2248654638ef1c3a495da05db77404ded0d41cffaf692b6
MD5 5b99a05bff18f993eb3777b450f92002
SHA1 0cd54fd9788931e72af645cd79881598c7e2b4ba
SHA512 e7b03832d27c893d926b2169aba9eece86348a090789d4ffb61ff84afc8be4e447279ae86f9672a5060a37f9440a591fcc601750244c159a6471d9fcc17b0572
TLSH
T134E026746BCAC73DD51871C742B4AB0CC3F0685693C93A8A574884A0A501718BFFED80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 14b0368737cb90a51cc74c026eb7dae28f0fef0fa60eb4095f71b8b6c98dba51
MD5 8fc0850c1c7e31862ecc80061904e2ae
SHA1 b2a2d109cc284078866f9adbb5e27442fe1c1a95
SHA512 5e544e6a81e8552544da8533a7ada003fa708718779d9de92a3ff12572bbcfedfb6f84f9923ee7f4254c253eb2cd53c3de6c9a047fc971cf8c9c873dcbfb7df1
SSDEEP 48:K0KGKhK8KgK+KkKkKdbKoKfKQISK4KdK9Kc1KeKdxK2KNYK3KIKkKtyLUjiu8+SV:KcGYKTCduDCKMUDOQKjqmOd+KO0R
TLSH
T142B1CA1071BB02103DBE79898A74971E61413173311AE62BBFBD446A9E6FE085DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 840bced5473a5ec442f75b9d4d6919702de50e9a01a80f45541443d39ee893f5
MD5 61f7fadd11b13480825ecd3cc10bb533
SHA1 62ea2f00809fb1b59a145e02939764c2577a26ed
SHA512 174abbf5bec210cf24c6024f3d1ee5be201708783754eee4335907e4ab293a8d995cfa0c3f02e2465b6714ac68911320485ce8e917a3f0f04d8bf56fc4620a0c
SSDEEP 384:DNrRZyCSDnxTICVZMEhIKyll7svbFKfk7:xFZJSDni1yI1l7svbF9
TLSH
T19E44840A7B747001EDE6D9725CB080771E3CB16D8F22A6916DA254698DF3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4a61c02-6a82-46da-81d0-df4e55a79847.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4a61c02-6a82-46da-81d0-df4e55a79847.tmp
Size 15KB
SHA256 40cdd27f8f5e895782a4e7e61c4cbe374066b442a7bb6aeef30abb3cd642f36b
MD5 593637247c119b8ed0e9836f833f6276
SHA1 91a129c983f10550523f9a7c2051c4c4a20e2a5d
SHA512 e55e3a645cc7310d89af6e743efcbc26d2dae48f1c29d4f096d7151fa956dfbc04136384141f34deeb58dc7234c783ca46e8f47272361d99eb164cd060b6702d
SSDEEP 192:sxR5RXEd/fnsvWpV5flZVn4UKvThCYVjoA8pJd3H/g6+WN1uo/QfshYM0n6GOIgU:sxR5ad/fnsvWvpLtVKvneP/5jLhJWp
TLSH
T1FD620945AD34693B5CDFD229FA56BF23D2FD1036A4915E48A6FC8A1C04E7ADD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0faf5c7-cb40-497e-9c9b-2ee2f1a18a0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0faf5c7-cb40-497e-9c9b-2ee2f1a18a0f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c31ccaf0-ad1d-4f7e-8f92-6ab4a110969c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c31ccaf0-ad1d-4f7e-8f92-6ab4a110969c.tmp
Size 12KB
SHA256 4921f81cfaa2d53e7a2f4daeaca579ea8dcb8835fe2066c10d3db1f50668988f
MD5 065f24c2e73f40597905b3ee3897b7cd
SHA1 663dd50818514ec030ee123f2b3e4e3540c15934
SHA512 edbecdc94cbf21fe3288702868ded5625bdb9000eb2ac06c4e100ee323341fad079e66e9181fa6193fceb605e9cbcb17415c3e3acc901da575abbfb4f0a02621
SSDEEP 192:sxRyRHCd/fns2ZlZVn4LhzoA8pv3H/g6+WN9fshYEdoUGOIgVwHJ:sxRyAd/fnsYLtPP/5ahxWp
TLSH
T18B42D955AE28A93B4CCBE31DBB55BF23D6F95032A0911E48F6FD861C04E7ADD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4cbbe39-a3b2-4597-a9f2-6ee1d14dd23e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4cbbe39-a3b2-4597-a9f2-6ee1d14dd23e.tmp
Size 18KB
SHA256 0f5cf5504175566c449abf50dbd39bb3f41234c96bc709511c8d5cd3725dbef3
MD5 d60370a192ad50e32a4bd83b0846eaea
SHA1 ed2cfb530228658caeb8f59c94c0ee1772e42748
SHA512 cb438631e5f97fdacee7dc5357d792712d2c7a34acadd2474f451e186ed1dd1f7914db60cc91d9e2897d944a99d8c3008ee961b2b05c86ff9136f6c8dc5b951f
SSDEEP 384:sxR5ad/fnsvWviLtVKvneP/5jLh4yNyBT:stad/fmYixn/55qBT
TLSH
T16982E746A924D8778CCBD62DAE357F62D7F904279C910A4C6AFCC91C04EB6FD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 f184bfe383119ff7b379e4140ac8996b6591bf42b26198cd3e420021485e2a05
MD5 d6057ffa85a24c8393f96a8dc60c69af
SHA1 43ae65855be616a6eff03f34b720499d4dae7dca
SHA512 ce45956da03ae7bf1186ef5c35c331686f7a3f3ad0d0b3da9c5a88e8e234849e1509f95d1f9d76e0b767bbef54dd8e00a742cc8cf78faee7f6c039e80c81c3af
SSDEEP 192:595QkIIIbbLMIMNsYcYADOwFAsJlip6ssY/:595QkIIIbbLMIM2BOw2sLms
TLSH
T13F42716E2B091B37C08E5F3A137B87555BD899818172612D32622C0F8DF3F9782D96F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 333cfa3b7100af4f8259968489508692357498f8e73ac0cf0fe710f55f650776
MD5 b3d4e44c5ea987f7ded40b624dfe2415
SHA1 a2e10b6e928a5686f7b45e31c857037e4d267165
SHA512 043aea774237477b84c1b2677c080ceb9c421afe9d10223c204e22521c7046a4f689b95a6df4eaff2a126f8ec91b6fffa56d7f597ac5d1e245b6377b90e3b0d2
TLSH
T1D4E02614BFDAC16EE12925CB42B85B0883853953EB88AA0A1F00C889A001308BBEE181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 032abe2848ca5064ad98d9d9dc92dcf78d5dd7648b87593d7762bb686b5ca1c9
MD5 8446009c08d0775f9f0d5894a69072d2
SHA1 a5bfbaf1390c6f6e31e7b16fd47829e640b500d9
SHA512 ce112e53aa0b5d6ac45a478a4de09bc5a970d39b3ee1a9ffdc798a1ff0d5d5ce82598a4d6744a66b93d0c8aefe26f0a5fb44421d5a7d4f2263df59d5e49df656
TLSH
T1E721E555F321C508E14E8639507E9B261338DC468FBCEC0F447520296E76B541E872E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 ea63a44912a00878b9d504300d43954d988be3e82bb2c3f64b76e4a88711aff0
MD5 d98b55cd04d2902d9784676a90daf3a8
SHA1 faace788b64ef9e5285a90dca49c23d85ef9b17b
SHA512 7b4cb52f7429e1342e5e0bab078a726d37826c9536fd7c8c2f4e3bc2d2a68efe57970e33412bea2f9c9de3cb158ffcd4dd29a4bb58fb6e4dc5ba6ad6e9dae9eb
TLSH
T189E020B47FC5C15FE52561C701B4974883953953EB846F051F40CC945101345BBDE141
MD5 SHA1 SHA512 TLSH

Submit Download

86eedf1f-b934-4a56-8655-ca3e58f8059b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\86eedf1f-b934-4a56-8655-ca3e58f8059b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 d53436a910274a94773c79affd20f5dda46cc3a0261aa4b127540072ed820280
MD5 e29afd3b49f24dcdb4e60297f2e86f40
SHA1 43ee1a99475efcc44961efb1dfeaff98421b7e68
SHA512 de0a5a498302beb63e0c154fe49328abf927139fb3037a4615fbf7ca7e985a3130cdb71c191812393a6334345b8c04ae7b9fd3cf24183eea7356daa8ea684c32
SSDEEP 3:MsEllllkEthXllkl2zEflcoh:/M/xT02zu
TLSH
T1C544040CFFC40405D50011305051C3D03374D5110511F7D33CD144735CC7D405F04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 46c6b703e4165c40279374771e57ce080229759a853f53529aea32c7b8c4df80
MD5 f119a06c3c66e88422a8ecd90b9d59b6
SHA1 94cd7536f210cf71e85e04f3713a36b52413e2ac
SHA512 765f40824a7f9350cb87e640a1b9fe3df0cdd358990ab44a802904ac2ad64a1d90d977607fac57605dea4a7f7126caf1caa673f4f842441594b0f0b37afdef21
SSDEEP 3:MsEllllkEthXllkl2zEflp3o7:/M/xT02zGY
TLSH
T1974404147FC4040DF500143040F1C3D01374D5100711F74734D345335CC75405D04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 648aec9aaefee7594fb01054917df3a5c4691179bd58ef1fea91ad261087f65a
MD5 a9ddadef5056d5041f7604a6841674f7
SHA1 751a71bcf5ee6ac29f880763022a14991edff000
SHA512 4a804ffaa7118bfbccfc0f2aeab023e93bc9e43ea24d62d6ae9cabf951b54d7306bac780f1c0f1f568109cf298aaba8881801f0f93c24c0f57b7ebdb3c8efd4d
SSDEEP 12:TL9C/JiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isnJazdnd13mQQta:TL+j0afDdWec9sJVUOGL3tpe1jy
TLSH
T1A79224676D351033E8EE4735BC934AE00EBC035E89B779548DE449221D71FC2E2995F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 691c0a5a2e40e902534b65a6ef63716ffc79a5c2a2584999445ea6a7045a8bf5
MD5 667aa7a08b3ebd12ef2ce4c597661445
SHA1 6e3558c135e670175f818f01f6cfc5fe0b60699b
SHA512 6f68d195ddd0c92499145213fd34dc9fa97324cc0ca52b22ad24282abf7153d63e3cd030bc1a4ebf6c13afafe3c092bc20171014978e0689947bd0cb477e2907
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 4a8438e073d120da90d6cbbab9d16f37d731ee7deae59fd0a35b6e3743e2e045
MD5 d0bb64aae6f5fdfb6aa2ae963cf94c78
SHA1 4430cf360c0368e760d77e2e8ebc616b8c4e13a2
SHA512 14317b76fc3bf90926916b1cf27fe7f887f5fa201eaa6ec6d4dd98b3952a149596a14da45bf5924a327ebb3b9bf3e671f31c0e652fc4633ea585b9fd6203b616
SSDEEP 3:MsEllllkEthXllkl2zEflW:/M/xT02z9
TLSH
T1A84404447FC41405D50411304053C3D01370D4710511774334D144335CC7540CC00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

aba475d7-e9cd-4538-9644-a438bf29019e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aba475d7-e9cd-4538-9644-a438bf29019e.tmp
Size 42KB
SHA256 d1bdd6e3b1e1c520fbbf3f277941f74b0f7ada9fcfd062ff9a0b60146868a1d6
MD5 cc000bae46a0ce059cd3ce7499c3bb62
SHA1 116b0b681dad0b9b3baf07f5a70097bcc58eafa1
SHA512 976bf73506ff4e7cb1e076413ad3c12c086b25445a9a617b8d2b793de7bfb96aede422e0119efd9f825de0e9af456b640e2ac1539c9c6d404111b8f302802a1a
SSDEEP 768:SFT6lwg3s6r6erKfcp5XSwQs88uBkiTlOQoaTZcaL/:+67s8rVILNByQ9Tz
TLSH
T1EC1338F598C38937E8AE4383677D2E469EBCD147B8880994B7C95C1CCC862BFE746815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00cd6e48-0646-47d1-ba78-488f2970e45a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\00cd6e48-0646-47d1-ba78-488f2970e45a.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

3f364d36-f245-4f06-a8d0-869420745ee0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3f364d36-f245-4f06-a8d0-869420745ee0.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ea044aff-3c88-4fb2-93f6-97bf17a75f22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ea044aff-3c88-4fb2-93f6-97bf17a75f22.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d0e6bb83-28c9-4980-b6d8-5363656b1547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d0e6bb83-28c9-4980-b6d8-5363656b1547.tmp
Size 38KB
SHA256 6477c700199c6f575f269ca095f492d72a9721339445656b5459692f23c9b48b
MD5 75e9286689c695feb4d842036706fa50
SHA1 6c845dc479eeedff858cdf003f5b16ed9060ae67
SHA512 934c938918f604a8bcc808c4016e61657ba4deb6a130f545e367f62620070bd25148560e20a44f5a4675b3a00535e394b0a61cfb80a36d3805aa5b34926d4f83
SSDEEP 768:d/UxvxjgC+W3Fvpc7fZrKfxp5XSwQs88uBkiTzNN/P84g:AZj3+W3FqtriILNBXNHg
TLSH
T1D903D039E8955C23ACF79350365B279BAFF060A7C4C00EA889EE6A0E018775D274B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4dd16ef-7998-428a-8e09-b8a1994e9967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4dd16ef-7998-428a-8e09-b8a1994e9967.tmp
Size 38KB
SHA256 a0c38c6ecd448968215c9b0b92bf29080254f1b523fd8976902d50fa1593c498
MD5 f0f65a96de3a0cfcbd2313f727ae50cb
SHA1 54fa792f4cab1939f35327facec5101aa0659cdd
SHA512 ffc2ef9a2fe82a937b722a777689888d7a97828d629a35584afa0752a8c39256831a735594fe4a1c321bde39415e8bb2abccb140a7acadee6a7d46a3552c7a69
SSDEEP 768:r/UxvxjgC+W3Vbbc7fZrKfup5XSwQs88uBkiT2NN/P8Rj:eZj3+W3VctrHILNBgNGj
TLSH
T1A403D039E8955C33ACF79350365B279BAFF060A7C4C40EA889EE6A0E018735D274BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e31a9be5-3f1b-4dcc-a2a9-add6d758c294.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e31a9be5-3f1b-4dcc-a2a9-add6d758c294.tmp
Size 38KB
SHA256 3ba3cc911e87d6074e76d8a84bde01dbe202a1ff3d8b4209cac38b73675d00a8
MD5 b0b801a9a79b6ec30144ab07d01d58b3
SHA1 3d190835f7880d77aa34b878b533313e34d76945
SHA512 62dd03c12ecd0dbdbc33c0e451fae7c2f7ca813f6b79b41019c3812ce2f0bad04b169ba537097fec5d97796568baa36dc155079921db86ae4eca55d1be179c54
SSDEEP 768://UxvxjgC+W3RsyPc7fZrKfup5XSwQs88uBkiT2NNSp:SZj3+W3RsNtrHILNBgNSp
TLSH
T1ED03C039F8999C63ACB7E351375A2797AFF02057C4C00AA889ED6A0E01C735D274BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea6c7ca2-e353-4fb9-b0f7-b057c333c502.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea6c7ca2-e353-4fb9-b0f7-b057c333c502.tmp
Size 38KB
SHA256 202440473c4a4932c586c7bb41108257173833e028e88a182b5b39ec6f947814
MD5 8606631ad0ace956418c86187d99beba
SHA1 c224909ee1671c5b9e9baf48dd345e2c2c308d69
SHA512 c55358a8f48c54161e96c2e31e8ffb17a4bea8ae51f20c12465793177c2c24dcb1c65c91a26d1493382940a71b8b3e51dcb35fa06dbcc523866cb57764e2b952
SSDEEP 768:z/UxvxjgC+W3ZsZPc7fZrKfup5XSwQs88uBkiT2NNSp:GZj3+W3Zs+trHILNBgNSp
TLSH
T1AF03C039E8999C63ACB7E351775A2797AFF0205784C00AA8C9ED6A0E01C735D2747C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e5461dd-5b8e-4e2c-a1b2-73e067d383e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4e5461dd-5b8e-4e2c-a1b2-73e067d383e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9d007ec4-c774-4074-a660-07450a90aa08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d007ec4-c774-4074-a660-07450a90aa08.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

a97d27d3-862f-42cf-b30c-354aea4866a7.tmp

Path C:\Users\Admin\AppData\Local\Temp\a97d27d3-862f-42cf-b30c-354aea4866a7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5484_1179639113\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5484_903222194\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5f12ab9-4d82-4ed2-a348-2e3899b8a3c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5484_903222194\e5f12ab9-4d82-4ed2-a348-2e3899b8a3c7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ec4fd6f-a179-46fa-8d86-81d6cf5657b1.tmp

Path C:\Users\Admin\Downloads\9ec4fd6f-a179-46fa-8d86-81d6cf5657b1.tmp
Size 512B
SHA256 82e5ae0d2147899371fb4f5d1a96a85b640a3d9b7ad9ee091d1725655073fedb
MD5 523abfc053cc3bcd57292d7ed6242eb7
SHA1 75b9fda21b5c9aa2321565c4a14b1a76ea688950
SHA512 df6997f90017cfebc470bdc097c1d6785cc443bccc4f5bfb5164b225bc3482f554b66c533e272a9a755106f1057fcb642ce97084325a1bf5a5b3cda6c03ba415
TLSH
T1A3F0866FD1FAAAE2C44C0475020A585061378A745ED88E136B75612E7C1E62C0AA5D01
MD5 SHA1 SHA512 TLSH

Submit Download

Saryx Free Fortnite.exe.crdownload

Path C:\Users\Admin\Downloads\Saryx Free Fortnite.exe.crdownload
Size 467KB
SHA256 1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2
MD5 99c93db31fc7b6770f028739ff1b7a6b
SHA1 acb2a7eea2abda987d43ed0208ce040fcbdf325f
SHA512 f15b6133825d6040527cb36ca40336b37a32dd1613dec6a5e38abf3adf9c218865d02ab99a5a0f3fc871f68fe4b41452ecc76ebc7a408500d5439e6af45855a7
SSDEEP 6144:JM6AUQIB7TplUxP1VPlFHpCjnp5JAkauKyFFixFv6o0skhSqRtGLcxQfSz:WdxZqNAxL8oFv6o0pGL
TLSH
T121A47C16FAA904FAE1B6A474C8735507FA327C590720AADF23E0495A1F73FD09A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6736_1255658442\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6736_128741261\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads