1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 467KB
Sample261111-kdfatagb28
SHA256 1bf03c02ed6d1928a698bbc448e515e03099b3c6af356a863dbfd59d7736f6e2
MD5 99c93db31fc7b6770f028739ff1b7a6b
SHA1 acb2a7eea2abda987d43ed0208ce040fcbdf325f
SHA512 f15b6133825d6040527cb36ca40336b37a32dd1613dec6a5e38abf3adf9c218865d02ab99a5a0f3fc871f68fe4b41452ecc76ebc7a408500d5439e6af45855a7
SSDEEP 6144:JM6AUQIB7TplUxP1VPlFHpCjnp5JAkauKyFFixFv6o0skhSqRtGLcxQfSz:WdxZqNAxL8oFv6o0pGL
TLSH
T121A47C16FAA904FAE1B6A474C8735507FA327C590720AADF23E0495A1F73FD09A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5864	icacls.exe
5824	takeown.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
2140	Process not Found

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5824	takeown.exe
5864	icacls.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1716	cmd.exe
2052	cmd.exe
4276	cmd.exe
5272	cmd.exe
5520	cmd.exe
4652	cmd.exe
984	cmd.exe
3352	cmd.exe
1620	cmd.exe
4140	cmd.exe
1680	cmd.exe
1944	cmd.exe
608	cmd.exe
3344	cmd.exe
1640	cmd.exe
560	cmd.exe
4336	cmd.exe
5128	cmd.exe
5184	cmd.exe
5228	cmd.exe
4816	cmd.exe
1756	cmd.exe
32	cmd.exe
3796	cmd.exe
808	cmd.exe
1648	cmd.exe
3000	cmd.exe
3080	cmd.exe
544	cmd.exe
2772	cmd.exe
2104	cmd.exe
2400	cmd.exe
1604	cmd.exe
2656	cmd.exe
1032	cmd.exe
4900	cmd.exe
1724	cmd.exe
5316	cmd.exe
4968	cmd.exe
3388	cmd.exe
2156	cmd.exe
2760	cmd.exe
4884	cmd.exe
1088	cmd.exe
5972	cmd.exe
4704	cmd.exe
3208	cmd.exe
1632	cmd.exe
5004	cmd.exe
4224	cmd.exe
1092	cmd.exe
4796	cmd.exe
1016	cmd.exe
4540	cmd.exe
1216	cmd.exe
4896	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5520	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
1716	taskkill.exe
4336	taskkill.exe
2760	taskkill.exe
1672	taskkill.exe
4992	taskkill.exe
5200	taskkill.exe
3208	taskkill.exe
1672	taskkill.exe
3208	taskkill.exe
1032	taskkill.exe
1672	taskkill.exe
3788	taskkill.exe
4276	taskkill.exe
4268	taskkill.exe
1672	taskkill.exe
408	taskkill.exe
608	taskkill.exe
4540	taskkill.exe
1088	taskkill.exe
4148	taskkill.exe
1724	taskkill.exe
2400	taskkill.exe
4336	taskkill.exe
4276	taskkill.exe
1716	taskkill.exe
4268	taskkill.exe
2052	taskkill.exe
4336	taskkill.exe
2052	taskkill.exe
408	taskkill.exe
4992	taskkill.exe
3100	taskkill.exe
1944	taskkill.exe
1672	taskkill.exe
4900	taskkill.exe
1724	taskkill.exe
5244	taskkill.exe
5288	taskkill.exe
5332	taskkill.exe
1032	taskkill.exe
1680	taskkill.exe
5156	taskkill.exe
5532	taskkill.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{75D1721D-4B6B-49B1-8DAE-800E6800A532}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	taskkill.exe
Token: SeDebugPrivilege	608	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	1680	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	5156	taskkill.exe
Token: SeDebugPrivilege	5200	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	5288	taskkill.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	5532	taskkill.exe
Token: SeTakeOwnershipPrivilege	5824	takeown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3344	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 3344 wrote to memory of 2308	3344	cmd.exe	95
PID 1952 wrote to memory of 32	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	97
PID 2308 wrote to memory of 5036	2308	msedge.exe	98
PID 5036 wrote to memory of 4532	5036	msedge.exe	99
PID 32 wrote to memory of 4156	32	cmd.exe	101
PID 1952 wrote to memory of 1640	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	103
PID 1640 wrote to memory of 3076	1640	cmd.exe	104
PID 1952 wrote to memory of 3796	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	105
PID 5036 wrote to memory of 4228	5036	msedge.exe	106
PID 5036 wrote to memory of 1824	5036	msedge.exe	107
PID 5036 wrote to memory of 2416	5036	msedge.exe	108
PID 5036 wrote to memory of 1824	5036	msedge.exe	107
PID 5036 wrote to memory of 2920	5036	msedge.exe	109
PID 5036 wrote to memory of 1824	5036	msedge.exe	107
PID 5036 wrote to memory of 2416	5036	msedge.exe	108
PID 5036 wrote to memory of 692	5036	msedge.exe	110
PID 5036 wrote to memory of 2920	5036	msedge.exe	109
PID 5036 wrote to memory of 2920	5036	msedge.exe	109
PID 5036 wrote to memory of 5116	5036	msedge.exe	111
PID 5036 wrote to memory of 692	5036	msedge.exe	110
PID 5036 wrote to memory of 692	5036	msedge.exe	110
PID 5036 wrote to memory of 4388	5036	msedge.exe	112
PID 5036 wrote to memory of 5116	5036	msedge.exe	111
PID 5036 wrote to memory of 5116	5036	msedge.exe	111
PID 5036 wrote to memory of 3316	5036	msedge.exe	113
PID 5036 wrote to memory of 4388	5036	msedge.exe	112
PID 5036 wrote to memory of 4388	5036	msedge.exe	112
PID 5036 wrote to memory of 4048	5036	msedge.exe	114
PID 5036 wrote to memory of 3316	5036	msedge.exe	113
PID 5036 wrote to memory of 3316	5036	msedge.exe	113
PID 5036 wrote to memory of 4048	5036	msedge.exe	114
PID 5036 wrote to memory of 4048	5036	msedge.exe	114
PID 5036 wrote to memory of 4416	5036	msedge.exe	119
PID 5036 wrote to memory of 4416	5036	msedge.exe	119
PID 3796 wrote to memory of 1924	3796	cmd.exe	120
PID 5036 wrote to memory of 4024	5036	msedge.exe	121
PID 5036 wrote to memory of 4024	5036	msedge.exe	121
PID 5036 wrote to memory of 4024	5036	msedge.exe	121
PID 5036 wrote to memory of 2052	5036	msedge.exe	188
PID 5036 wrote to memory of 2052	5036	msedge.exe	188
PID 1952 wrote to memory of 4968	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	123
PID 4968 wrote to memory of 2400	4968	cmd.exe	163
PID 5036 wrote to memory of 4512	5036	msedge.exe	125
PID 5036 wrote to memory of 4512	5036	msedge.exe	125
PID 5036 wrote to memory of 4512	5036	msedge.exe	125
PID 1952 wrote to memory of 808	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	126
PID 808 wrote to memory of 4796	808	cmd.exe	165
PID 5036 wrote to memory of 4548	5036	msedge.exe	128
PID 5036 wrote to memory of 4548	5036	msedge.exe	128
PID 5036 wrote to memory of 4548	5036	msedge.exe	128
PID 1952 wrote to memory of 1648	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	129
PID 1648 wrote to memory of 4444	1648	cmd.exe	130
PID 5036 wrote to memory of 1808	5036	msedge.exe	131
PID 5036 wrote to memory of 1808	5036	msedge.exe	131
PID 5036 wrote to memory of 1808	5036	msedge.exe	131
PID 1952 wrote to memory of 3000	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	132
PID 3000 wrote to memory of 4192	3000	cmd.exe	142
PID 5036 wrote to memory of 4668	5036	msedge.exe	134
PID 5036 wrote to memory of 4668	5036	msedge.exe	134
PID 5036 wrote to memory of 4668	5036	msedge.exe	134
PID 1952 wrote to memory of 4224	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	135
PID 4224 wrote to memory of 4792	4224	cmd.exe	136
PID 1952 wrote to memory of 3080	1952	2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5740	attrib.exe
5784	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_99c93db31fc7b6770f028739ff1b7a6b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff85e6cc188,0x7ff85e6cc194,0x7ff85e6cc1a0
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,15590811096156288029,14907312295090033670,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14933417854531257520,8623071113056037260,262144 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:2
        5⤵
        
        PID:1824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,12263131996121768087,6609443655207798780,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3068,i,6631147589371436948,3191890925638744701,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
        5⤵
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2972,i,13987451878790916472,459229016528432734,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
        5⤵
        
        PID:692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3768,i,17150067314383695307,6797804077863510998,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
        5⤵
        
        PID:5116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3788,i,1204847478522823593,12495566483327368985,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
        5⤵
        
        PID:4388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3304,i,17791201837568494340,12077890105481098131,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3320,i,857179101222460909,5728330570711386541,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7304693311220742856,8109255142966128776,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
        5⤵
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5516,i,6226602922904817468,2163197311363372416,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
        5⤵
        
        PID:4024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,15071042023927317013,12097654992900450333,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
        5⤵
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5252,i,17643943351803898300,13896611080822563450,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
        5⤵
        
        PID:4512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5504,i,18191212500910196153,16824748777891147926,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
        5⤵
        
        PID:4548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5440,i,2094494927776367124,915550808197988065,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6028,i,3686632968054328201,10627953318712146426,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
        5⤵
        
        PID:4668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6248,i,6149033341127909140,2369896612443709473,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
        5⤵
        
        PID:3644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6388,i,496604783989303807,6558362629760383864,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,15498149036680336739,12359321889273386188,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
        5⤵
        
        PID:4192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,4459157118346809084,5065111386287393864,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
        5⤵
        
        PID:3168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6964,i,12847413873727027466,1743148893762551802,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
        5⤵
        
        PID:1744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7476,i,3965761020361846542,1473015900429306246,2097152 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
        5⤵
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,6599172005685612913,12220038046038977809,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:8
        5⤵
        
        PID:712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,6599172005685612913,12220038046038977809,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:8
        5⤵
        
        PID:2132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,14684102902067147323,9411651549174634068,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:8
        5⤵
        
        PID:2420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7964,i,9248638584970667296,4149824570882498834,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:8
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8460,i,11145282835356053046,15927162611291812176,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:8
        5⤵
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8464,i,17982534407469710946,18031981366657701283,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:8
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8468,i,652146360970389247,2545475004765906566,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:8
        5⤵
        
        PID:6004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8740,i,9734498149797132506,14284292711672133222,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:8
        5⤵
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8880,i,11118050571642194753,7417593969343573368,524288 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:8
        5⤵
        
        PID:1664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9208,i,13884277416609799037,11640954395523092689,262144 --field-trial-handle=3860,i,7369736624921883375,3274659132235639633,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:8
        5⤵
        
        PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
  2⤵
  - Executes a command shell one-liner
  PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
  2⤵
  - Executes a command shell one-liner
  PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
  2⤵
  - Executes a command shell one-liner
  PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2156
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4652
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4140
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:608
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1724
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\MyCheat" /f
  2⤵
  PID:5560
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
  2⤵
  PID:5604
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:5648
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:5696
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
  2⤵
  - Views/modifies file attributes
  PID:5740
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
  2⤵
  - Views/modifies file attributes
  PID:5784
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

office_antivirus.dll

Path C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll
Size 23KB
SHA256 81472a56e18034f16bc2b73c7025a1137942ce0db43bd7eb6c4095e56392adcd
MD5 6e5394b57a7ec6ca393e00bdea821cee
SHA1 3fa7d442565dbf4fbd3ef5864aade290ece1c7c5
SHA512 b69fcb8404e5a4a86c2b0baf780bdfa18febf1f6fcd8c2279afb76805607b92526d89c54f3b059b2c0e867c846975b1fc0ff69b0c27fec5a242f49bbf4b93bf5
SSDEEP 384:s4ZzQHvy1MshplRXvPKgGthUpH8DZvzZUhCm/Ct:s1P2M0plR/JGtup8lvzZxKs
TLSH
T1FAB27CC2BF1D04E6DAA14670C8E31D07FCB7B6E407642AAF026095660ED73D2BF27428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14f10645-19bf-4ec1-958e-d2c2caecf407.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14f10645-19bf-4ec1-958e-d2c2caecf407.tmp
Size 10KB
SHA256 cc848cb5d0dbad8116ba2e7eed7ba4ddd60348def466a26bab53031638bd2e2e
MD5 93e8e622c1f9a8dc1b137c3095e1b4ab
SHA1 1318b200270ad880745be1f7f3da32ce9fcb45a6
SHA512 fc526ba0402f1305d51a29f6ab0d36a1036b29773a63ee637ccdf0be95678425b1c141cd214172825c6a83ff34231be67ff4c88eac7df72ca6412ed775524170
SSDEEP 192:zesNzVQvUjvIUbXuQmiU17EvBZh//S+ZhNorq+U9:zesNzVkoRb6qvfh//S+Z4BU9
TLSH
T11A321935BC78AC7A9DA79591F44B3A138FA44127EB882F90D6EC2E2C01DB29C5307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

276d4b19-fb16-467b-8f15-4e53d9f847ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\276d4b19-fb16-467b-8f15-4e53d9f847ac.tmp
Size 12KB
SHA256 653197e07765bf01b26733457fd7ba9a353e93bb8d200aa8009233b07dda19ea
MD5 b532eb1ab2eb9d785f3c3a552db1033b
SHA1 55b7a9a08b8fc8ffeeafc1f29cc3966012cabc7a
SHA512 143beda9b9f716f68c4214e0730d418390b4c9d3f4345a4986257f569677e95dcec1b551bf78f6ac2def03540427f021613358a9eb603ae06788020e2b75a8f8
SSDEEP 192:zesNzpQvUjvIUbXuQmiU1XqEvl1h//S+ZhNorq+cVBzt:zesNzpkoRb6rvTh//S+Z4Bmt
TLSH
T14A422839A874AC7B9DAB9585F44B3A138FB48167DB882F94C5EC6B2D01DB29C0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ee007af-c8cf-48d9-af60-ad8c9507c9be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ee007af-c8cf-48d9-af60-ad8c9507c9be.tmp
Size 12KB
SHA256 723d309835212805954fa2f652cdc59717fd0d13b9b0841cb136cd2cf306529c
MD5 4c0e5dd208cc95047e865278955a6fe1
SHA1 dcb577d1c5e4e4b11bd45aaf3b8cfff5b3a65095
SHA512 110b0fcc2d62becab6ed087eb03834e5cebc5951a62890e18297478b91a73299efbef9589e6e7894c040ca8de5423ab919e668b926a6205ed361317188ec67eb
SSDEEP 192:zesNzbQvUjvIUbXuQmiU1IEvKOh//S+ZhNorq+cVBzt:zesNzbkoRb6Bv7h//S+Z4Bmt
TLSH
T177422839A874AC779CAB9585F54B3A138FB48067DB882F90C5EC6F2D01DB29C1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f2f48b8-7958-4bcb-846a-98030e9550e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f2f48b8-7958-4bcb-846a-98030e9550e9.tmp
Size 8KB
SHA256 cbdb6b740d1b4783c32a98d2f19df19237adaa55ef70a4c463822b4eb07980e5
MD5 347711d858d27895b22fd49607eae5d9
SHA1 3af3860d834dda6312a78c611cb49da0dd16c712
SHA512 804ff9e0d20ef856b066357be23b02cce4a7a70254f8d2370fe7ea5644aff78965bc2772cb64fd27d9ca9e3b516114faf39e31ee5f0cac42104ad8c9386b6478
SSDEEP 96:kqONk6QsjpfbU+H5ih/cIPURHl8h4otop5ZCD5BAP4v+Y1xf//ojdqxERtIsx6Lw:PONO6JUVQmiUyafSo//S+ZWNxrq+U6
TLSH
T165120939B878BC7B5D939481F0873A138EA44167DB856F94D6EC2E2C05DF29C2307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63d79d8f-6baa-4e94-9618-d94ac2384c0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63d79d8f-6baa-4e94-9618-d94ac2384c0c.tmp
Size 18KB
SHA256 5c57d987754ff19e72dd54412221446a0ef746274e7849c304e6420b5f348455
MD5 004c94135121ee0aa5b3648c8f1248f8
SHA1 cd3c1fcd9a780506271dac8b0ab0982c85eb4fba
SHA512 2f8a6502c7f9e8f136b9dc15723dc2f7c7c4e89b57d45a26a2d513fbc14b08dce4a0fab355e4009ae2e42c450ada0fc64c0ce8d3d8119de604159e26ca7c5c66
SSDEEP 384:nQQkUSv0sNzFkoRb6NvKh//S+ZNBH7vBEQxIIlE:40jq/KeBH75EcL2
TLSH
T1F4828C35A8B8AD7B4DF79540F14A3A138EB49017DAD81F90D5EDAB2D01CB29C234BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8504eb8b-c3c0-4a19-85ec-ab017f665e0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8504eb8b-c3c0-4a19-85ec-ab017f665e0c.tmp
Size 18KB
SHA256 23890eb53cad6eca23dc339ffff930ca52b3ab351028477793a5ffaaa7cbd74b
MD5 71fff5bd3ce401e68f905e1c882a59dd
SHA1 756542327b2e9a715185f8c8c0a5b19ccbe30e82
SHA512 ddd76ffe3daabad330f5d9389208c18042eaee96dfe307599748850649aab2d3ddfe007f3b3da8a5eaba5a784658f7ebe62bf77aa4457f5a782d2f86d5bb6f31
SSDEEP 384:nxQkUSvIsNzIkoRbsNvKh//S+ZtBH7vBEQxIIlE:jI4q/KKBH75EcL2
TLSH
T17E828C35A8B8AD7B4DF79540F14A3A138FB49017DAD81F80D5EDAB2D01CB29C234BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89770d3f-8b87-478a-bcf7-2b1591a2b85e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89770d3f-8b87-478a-bcf7-2b1591a2b85e.tmp
Size 12KB
SHA256 1ef7bdbda375ad05955cc744650d979a52e0cea62058c7825ada1a26c080e2fc
MD5 2092ec4e1d1b06b8397714c63517dae3
SHA1 eb3214cf97a346d928a16a8dc7dcca91b43d9b80
SHA512 3e7e3a312f35e38eedca3b6046196e47e1583d89ac512f961579ff8698a74639b859651963456e53bfdb2e6ff5a548bb04532ebb14f0a1eb649d58842a175c97
SSDEEP 192:zesNzXQvUjvIUbXuQmiU1bEv11h//S+ZhNorq+cVBKt:zesNzXkoRb6uvPh//S+Z4BPt
TLSH
T1C8422935B874AC779DAB9581F54B3A138FB48067DB882F94C5EC6B2D01DB29C1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ff6b54c-bb94-4b37-8e4d-7a64d23aa32c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ff6b54c-bb94-4b37-8e4d-7a64d23aa32c.tmp
Size 12KB
SHA256 ae8f008dc0086d75024e3100b5a043002cd93d458c02aa792aafb12a74ff162a
MD5 7276fbd138b68b5ef6d1dddbebc43e46
SHA1 18fbf5ca4ba6697b9480edfa2b3e6fcb74dfebb6
SHA512 0134e7d94564ee68689dea1380d12a01f4ae969f548b4f277a63c5383b0282cf11a009b3f39d81004eb91db6361e1b7ee4ff55137844bfd47daaeeb8e64dadd8
SSDEEP 192:zesNzeQvUjvIUbXuQmiU19EvT/h//S+ZhNorq+cVBJt:zesNzekoRb6Mvzh//S+Z4BQt
TLSH
T1DC422939A874AC7B9DA79585F44B3A138EB48067DB882F90C5EC6F2D01DB2DC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cee6f078-89a1-40ce-ac71-67eb4a5a8353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\cee6f078-89a1-40ce-ac71-67eb4a5a8353.tmp
Size 105KB
SHA256 f177a9ca2ff22dbc463fdac60c9dddb266a340db1e1d3fae8f0d915baa7c0b70
MD5 3e0bcbe3e53357294b3c897458db4b90
SHA1 0d306ace9c82f16f6fa4f75eb52ad1c738a013ce
SHA512 488de48186b8b77ac8d4750db93a2b93bf0dfeea523717d10c7e0eef9902eb9ee2db3f0bd5edde32a4e252219ee3d7290532c43a320be0f9bd6d4bb0aca81964
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T17CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

053ed54e-174b-41bf-915a-0e07d0c37e68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\053ed54e-174b-41bf-915a-0e07d0c37e68.tmp
Size 10KB
SHA256 614e73149985020756e08af8287ca631e40d70fbd2697c619a4ec30fe005946a
MD5 35e2c9e67bad55d364da941b348719db
SHA1 6d6376c7d79b46d5f27c9f93c558525c6013e902
SHA512 ebe120a754a5d7648c80750fe32ecd49418bd921bca167942ea4a65ce3e8dee7e30ef7e4836bfb32d73f449a5e2a1d63cc55a3578e3c2cc9260439295ed61d93
SSDEEP 192:sxZJRGZT/fgskmIdp8EeHW6+WNn0KZY367SIKIg5KJ:sxZJUT/fgskH0HblZXmA
TLSH
T1C032C855AE246A7B4CCBD219BB15BF53E2FD503290D11E48A6FCC62C05E7ADD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

144963c7-8216-4e88-935f-47d7153102fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\144963c7-8216-4e88-935f-47d7153102fc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

22006f5e-5dce-4114-8f2c-41a5a8b63801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22006f5e-5dce-4114-8f2c-41a5a8b63801.tmp
Size 10KB
SHA256 1aef780e4dc6575f7658e11e5007390333e55dfbb7b3a5898576a9a91314c64d
MD5 d2d0e0ff444c7f3c2c7eb37b54edecc9
SHA1 8dac96b4ad4d2a86a6623e4b2877801cc4b0264d
SHA512 fc67335e93b2d06889be3ae415906e56c1cf349b347659ea840466078f4196be17efa72ec5999c0a7f0d55a7f2ad3effd554a75bd8e300ee2ea9701577d2cc8b
SSDEEP 192:sxZJRGsT/fgsCmIdp8EeHW6+WNn0KZY36w0IKIg4J:sxZJdT/fgsCH0HblZXdc
TLSH
T11522B9556E34667B4CCBD219BF29BF13D2F9503290D51E48A6FCC62C05E6ADD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ae8315e-d906-4465-91dd-b81ce38695d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ae8315e-d906-4465-91dd-b81ce38695d7.tmp
Size 11KB
SHA256 5e058175c277ca65c400e8503f8e6ce4e1333b2261eed4cfaabb12afdf3ce79e
MD5 f354ef8649aec7513229df1c46ec1515
SHA1 02d1685104a1f5e03e6f8970bbd335f0378d5786
SHA512 7371d2bcf0d7880be2e2e2b96c2edfadbfd51f19f1c158a6f4df1f5f9898c7785ae680fe0dc032165d5e4ce406a178a14d9f4044bf15d1d59b190ab1c649cff3
SSDEEP 192:sxZJRGZT/fgskmIdp2EeHW6+WNn0KZY36gFLKIg5KJ:sxZJUT/fgskHWHblZXfA
TLSH
T17B32B856AE246A7B4CCBD219BE15BF53E2FD503290D01E48A6FCC62C05E7ADD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e5a42ed-f78a-4523-9dc4-ae45fd28511a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e5a42ed-f78a-4523-9dc4-ae45fd28511a.tmp
Size 27KB
SHA256 d517074eaf56a49e9de87fd0fbc54d2871852542954595151d3321e9f4b5c992
MD5 ebf7682f059f72048eca778e295d15fc
SHA1 821a359ae4ddac2f1015c77bec3ae1ac81571034
SHA512 2fd6c0c9a2a8ff56205a2fc20c71e19c4b7a5c3d33ffcafef29724505dd55ca7194e5c0b16c7f6e63d3cee616d4a1fdc2a2c8ed4011f96921b485bd658ee8364
SSDEEP 768:ScKlm+QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVc/LlpPs/Zro+A:ScKlm+QWvUYe0u1jaT/L/E/S+A
TLSH
T16FC2FA3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efc1a815-98b3-4ef5-a403-6b6df4907e01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\efc1a815-98b3-4ef5-a403-6b6df4907e01.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

18f53b36-37aa-48c4-adfb-cf814a7c1d7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18f53b36-37aa-48c4-adfb-cf814a7c1d7c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

390706aa-1e09-4eb5-8c3e-1b58b31c9720.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\390706aa-1e09-4eb5-8c3e-1b58b31c9720.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b804bca1-3192-4213-ad36-8813014fdea1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b804bca1-3192-4213-ad36-8813014fdea1.tmp
Size 1KB
SHA256 387bb3d733c6f8ec5742e213c532e593feab944cfac6916545741ce0eeaf3003
MD5 b3c6a68f0abac90ccc4ee1916d62c318
SHA1 48067e3671ea376538bfd729c149bce42ec39924
SHA512 d38ace6f266891dac9beaa0d01927894c1d8a49c3bea35064b2ff076b88dc292d635a982a6b2fd594249af982706735fc5e0074f08f38633c559de3cafe012d9
TLSH
T104316CF7C3D4856E890156F4AB28AF1FCE2E0A15421C3C1A89E4EF2B93E3475E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b0360f052cf2ae374cd832c908791bf80d3e28a9af700e225a48baaa744a67fb
MD5 222b9316c5f9deba34ee0758bb2b623b
SHA1 ac466345a830fbf315f8c540f4cbe6fca2400808
SHA512 da6e1c1d58258e9316d09e2e0937bab40c9a1f038e5df3e9045fb41e3bd1cfa65614a08c57a385949a149878e1aa641dd4bf46baf9f6260d2a68c864d0a8c582
SSDEEP 48:K0Mb6G02aDbqpyIS+DK9a14Dx8TYRi6AyLFk51Hznob7+7ISNoK9t1foxt4Yuf17:KILSKEkOKK4KP6ce0KDqeul+KOAN
TLSH
T14BB1011176BB124139BE24988276871B524135733418F72BBFBC50A5CE6FE081DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc6b567c-9d92-412a-a626-562dda442c55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc6b567c-9d92-412a-a626-562dda442c55.tmp
Size 10KB
SHA256 e915acaac1727c7f4dc1c4723caefd33682be85a7048216d2d6e43dfcb30a21a
MD5 9962f449647914aedc31c5c9b23ae8a2
SHA1 b1aaf7f6bd97c4e4688566d144bba9547f9dd849
SHA512 894cf8ce1471b7673a86cbb85fdb393fa9b119fa80fe01f0afa752c968c6504db6cd5ebb52059cb376396b5423bcf8febd9fce0d3624491876d46eadec6e2b63
SSDEEP 192:sxZJRGsT/fgsfmIdp8EeHW6+WNn0KZY36w0IKIg5EJ:sxZJdT/fgsfH0HblZXd2
TLSH
T17522C955AE346A7B4CCBD219BF29BF13D2F9503290D11E48A6FCC62C05E6ADD225780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b246cc-aca3-40bd-a900-8f3f4f14b8b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5b246cc-aca3-40bd-a900-8f3f4f14b8b8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c31a32f9-33dc-4756-b6cf-0dcfbf62ff92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c31a32f9-33dc-4756-b6cf-0dcfbf62ff92.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad28f724-fd3a-43dd-aa28-3542c3d74000.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad28f724-fd3a-43dd-aa28-3542c3d74000.tmp
Size 8KB
SHA256 39ae84a65b5114ddd111a467959ddd63fc07ee190a87e089ee477eaa5f581911
MD5 8876d0c73b33cd92085b9121829677c7
SHA1 7bc18c1cce5ce1350b7bc65f67bb6c1d2d8fb418
SHA512 9aee390f598adbcd655c7d75430dea772d49928f3f8b96642b1dc075079694ec4c3ee941fff4f37df8138d7facb1055c0b8aa26d37ea99e2658c18151a6c9c8a
SSDEEP 96:KqONkiQsjpfbUmjH5ih/cIPURHl8h4otop5ZaD5BKP4v+Y1xf//ojdqxERtIgBCw:BONm6JUm0QmiUySfso//S+gBCUQ2U6
TLSH
T1FC02C739AC786C7B8EF39E45B0477B239FA4106BA6916F84DAE85E2D01D725C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf4e1d68-28aa-4a03-a2e7-e45972440168.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf4e1d68-28aa-4a03-a2e7-e45972440168.tmp
Size 28KB
SHA256 6a568faf1895b5c119f68dced28606fae2bf8f97c156e8e626df7948abc34b7c
MD5 cccae67cd44a8541d2bfde8824c940ac
SHA1 88bf3390491923314d89ed2b7614b11bdf34ec35
SHA512 1939a6054b9508225c4b93195ce990824cdb42fbed005649f46d149bad76ca4a40c7810eeb5850b503b77e1585bd2bc3951e59012f5798a786517ea725e5ecc3
SSDEEP 384:nPiFgQkUSvGLsNN8TUNTUlIlIkoRbsIvKSDfYa//S+Z9BH7vBEQxIIlE:aFIG8wggia/KkBH75EcL2
TLSH
T196D2A2F598D79A3AE9AE4783A33E3D428EBCC153B5885980B7C95D1CCC861BFD306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7adb50b5-8ee7-4c7a-b3fe-1ff40a032180.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7adb50b5-8ee7-4c7a-b3fe-1ff40a032180.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d69a4777-e8b4-4ee3-9584-a424cd95bb4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d69a4777-e8b4-4ee3-9584-a424cd95bb4c.tmp
Size 12KB
SHA256 0fa8b058287e4bae8a19a69ecaf8b6981de02b3b556311f49332148d3282ecc5
MD5 b838fd251929b2556bbbca69244ec7fb
SHA1 bd1b825ebeeb17569d586693844a8bd3fab48f39
SHA512 6283c9ab0624f8ad592f14830759d25580cea6a0ffa54fb316d60cfba80ae41e160845c4d93498c63e0b74c31e88506f5d6636026c7912590d5f74234efca0f8
SSDEEP 192:zMLsNzpQvUjvIUbXuQmiU1HEvGHh//S+Zhaorq+cVBzt:zqsNzpkoRb6evAh//S+ZNBmt
TLSH
T15F422935A874AC779CABA581F54B3A138FB48167DBC82F94C6EC6B2D01DB29C1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe6b5f4d-a7b3-4801-977b-18d878e87029.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe6b5f4d-a7b3-4801-977b-18d878e87029.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00fcaa8fa95efdb0a102b044d7a9e98c36ce6cefe4c860a5f7b6c99c75189857
MD5 828cf96f05b7bee3c2ff99acddff729b
SHA1 18dd82781a1d7a38e18847814f1ac314c757951a
SHA512 36191cc9ad810ac0bd56e91985f9870d9d08c667baa41e10ff6e5092b8915e97c05a369bb7383c920d193341811e3ef864ec18fed78af9c997261c418501e383
TLSH
T1D541D868A6EA114CB3B77F1AABF3A86D487A7D372E0B945E50110D4F0A62B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

92ac8b36-aa52-42bc-aeee-934d920ba07c.tmp

Path C:\Users\Admin\AppData\Local\Temp\92ac8b36-aa52-42bc-aeee-934d920ba07c.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8b8cadb-eeb7-4658-9af9-adc8a40f6c29.tmp

Path C:\Users\Admin\AppData\Local\Temp\e8b8cadb-eeb7-4658-9af9-adc8a40f6c29.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

681988a9-0cc3-4f88-b553-79a2b729d25d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5036_131357907\681988a9-0cc3-4f88-b553-79a2b729d25d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads