0bbe65f5c176ca944f1066d6d265df8a9d049980089abb004dc8055393dc7873

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 18.0MB
Sample260702-ax3kcaav8x
SHA256 0bbe65f5c176ca944f1066d6d265df8a9d049980089abb004dc8055393dc7873
MD5 05985e6b22939b890c03cfb5568c3c48
SHA1 17e64714919b66c55ffa7ebd806138ca935436d8
SHA512 b528b615c936049bc313cd2a3441d3d406293f2ebd6810ad7eff9f93c817526ab4c92e3c448bf4617c41ec0bdf3d79668058623d5397ec0fe5f39646ce6fc640
SSDEEP 196608:N6ZgpbLFmsdg/XhGUOmDx4v1GKR4LbUp3xWcMCLezU6bX58VdTLeYjJKa:zmseXhGBcx21mC3EhCyQ
TLSH
T1ED173350A16580F0F6BB877954BB5C49DF70308BCB0B794E0628F2EA2E63B42EC76755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 22 IoCs

description	pid	Process	procid_target
PID 5476 created 6180	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 5476 created 6176	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 5476 created 6096	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 5476 created 5908	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 5476 created 4304	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 5476 created 3696	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	96
PID 5476 created 3012	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	97
PID 5476 created 6180	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 5476 created 6180	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 5476 created 5908	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 5476 created 5908	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 5476 created 5712	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	116
PID 5476 created 4676	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	117
PID 5476 created 6460	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	118
PID 5476 created 7120	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	119
PID 5476 created 4232	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	120
PID 5476 created 1824	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	121
PID 5476 created 5944	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	122
PID 5476 created 5712	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	116
PID 5476 created 5712	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	116
PID 5476 created 7120	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	119
PID 5476 created 7120	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	119

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5908	chrome.exe
7120	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274262081102067"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{718DC496-E147-442D-920E-3F854A0811A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
6180	chrome.exe
6180	chrome.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
5712	msedge.exe
5712	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe
Token: SeShutdownPrivilege	6180	chrome.exe
Token: SeCreatePagefilePrivilege	6180	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
6180	chrome.exe
5712	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 6180	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 6180 wrote to memory of 6176	6180	chrome.exe	91
PID 6180 wrote to memory of 6096	6180	chrome.exe	92
PID 6180 wrote to memory of 6096	6180	chrome.exe	92
PID 6180 wrote to memory of 5908	6180	chrome.exe	93
PID 6180 wrote to memory of 4304	6180	chrome.exe	94
PID 6180 wrote to memory of 4304	6180	chrome.exe	94
PID 6180 wrote to memory of 3696	6180	chrome.exe	96
PID 6180 wrote to memory of 3696	6180	chrome.exe	96
PID 6180 wrote to memory of 3012	6180	chrome.exe	97
PID 6180 wrote to memory of 3012	6180	chrome.exe	97
PID 6180 wrote to memory of 3112	6180	chrome.exe	98
PID 6180 wrote to memory of 3112	6180	chrome.exe	98
PID 6180 wrote to memory of 6780	6180	chrome.exe	99
PID 6180 wrote to memory of 5436	6180	chrome.exe	100
PID 6180 wrote to memory of 5436	6180	chrome.exe	100
PID 6180 wrote to memory of 2044	6180	chrome.exe	101
PID 6180 wrote to memory of 2044	6180	chrome.exe	101
PID 6180 wrote to memory of 6808	6180	chrome.exe	104
PID 6180 wrote to memory of 6000	6180	chrome.exe	105
PID 6180 wrote to memory of 6808	6180	chrome.exe	104
PID 6180 wrote to memory of 5356	6180	chrome.exe	106
PID 6180 wrote to memory of 6000	6180	chrome.exe	105
PID 6180 wrote to memory of 5356	6180	chrome.exe	106
PID 6180 wrote to memory of 5496	6180	chrome.exe	108
PID 6180 wrote to memory of 3860	6180	chrome.exe	109
PID 6180 wrote to memory of 5496	6180	chrome.exe	108
PID 6180 wrote to memory of 3860	6180	chrome.exe	109
PID 6180 wrote to memory of 1284	6180	chrome.exe	110
PID 6180 wrote to memory of 3780	6180	chrome.exe	111
PID 6180 wrote to memory of 1284	6180	chrome.exe	110
PID 6180 wrote to memory of 7092	6180	chrome.exe	112
PID 6180 wrote to memory of 3780	6180	chrome.exe	111
PID 6180 wrote to memory of 7092	6180	chrome.exe	112
PID 6180 wrote to memory of 2520	6180	chrome.exe	113
PID 6180 wrote to memory of 2520	6180	chrome.exe	113
PID 6180 wrote to memory of 3644	6180	chrome.exe	114
PID 6180 wrote to memory of 3644	6180	chrome.exe	114
PID 6180 wrote to memory of 1484	6180	chrome.exe	115
PID 6180 wrote to memory of 1484	6180	chrome.exe	115
PID 5476 wrote to memory of 5712	5476	2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	116
PID 5712 wrote to memory of 4676	5712	msedge.exe	117
PID 5712 wrote to memory of 6460	5712	msedge.exe	118
PID 5712 wrote to memory of 7120	5712	msedge.exe	119
PID 5712 wrote to memory of 6460	5712	msedge.exe	118
PID 5712 wrote to memory of 6460	5712	msedge.exe	118
PID 5712 wrote to memory of 4232	5712	msedge.exe	120
PID 5712 wrote to memory of 4232	5712	msedge.exe	120
PID 5712 wrote to memory of 1824	5712	msedge.exe	121
PID 5712 wrote to memory of 1824	5712	msedge.exe	121
PID 5712 wrote to memory of 1824	5712	msedge.exe	121
PID 5712 wrote to memory of 5944	5712	msedge.exe	122
PID 5712 wrote to memory of 5944	5712	msedge.exe	122
PID 5712 wrote to memory of 5944	5712	msedge.exe	122
PID 5712 wrote to memory of 2392	5712	msedge.exe	124
PID 5712 wrote to memory of 2392	5712	msedge.exe	124
PID 5712 wrote to memory of 5464	5712	msedge.exe	125
PID 5712 wrote to memory of 5464	5712	msedge.exe	125
PID 5712 wrote to memory of 1752	5712	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_05985e6b22939b890c03cfb5568c3c48_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbdfa4c728,0x7ffbdfa4c734,0x7ffbdfa4c740
    3⤵
    PID:6176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,6763041452618931338,3480720498736215974,262144 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,7748818422823120688,16305191180738043832,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,12917712014792137832,4765991270866835020,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,2019052293907534794,13820410029034665115,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,5718360499672220500,6288186985505004627,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,2439803279439342049,3548550649687398027,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:3112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,13357607101832340407,12302380168820257842,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:6780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5452,i,12420133563517671668,4553148881400941430,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,16252815317307413319,3789294746934713587,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:2044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5828,i,14807141120770743977,5113228714339030530,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:6808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5840,i,7053721020020228119,7678835783106724696,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:6000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,169890014504634550,15190999773069599714,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4772,i,15770886336981928782,13210077918266591195,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3772,i,91438236965111119,5083910964121833556,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:3860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5712,i,405808273724766046,7737902886005659676,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,3077152176533717420,17342877509951688526,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
    3⤵
    PID:3780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5404,i,6033831525534617730,4968702763911113166,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:7092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3056,i,18118651348193928167,11690992495804923389,524288 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5432,i,16594667946289405663,3518194707021396843,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:9
    3⤵
    PID:3644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3096,i,17986315647629086966,11321618453834517842,2097152 --field-trial-handle=1924,i,44012063745803665,11238980619328942971,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffbc2f8c188,0x7ffbc2f8c194,0x7ffbc2f8c1a0
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1720,i,18098092311210472049,15814156546620820240,262144 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,14863894569964188185,3052253619179646162,524288 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,15898783558351638839,5201736643995477826,524288 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,7471126178677370474,16466296851484652303,2097152 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,4593098372356022546,7049063544155026529,2097152 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,1066117236915459989,6403567492050213209,524288 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9593429052158236728,8497189812081068650,524288 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7205300165629063863,10508393536661197595,524288 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7205300165629063863,10508393536661197595,524288 --field-trial-handle=2308,i,7365311940729451263,12577954429145937848,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:1752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 7f3c59b2553496d984e24f5cb3d46b43f1a0c54821e2a9f6b1a85006d70ea438
MD5 6477b47ce333fb89c895fd8189d5e8f4
SHA1 508236d3da8bd6b4031bec3ae2e25c66b1a4e2d9
SHA512 7f2b44811679b3808d047faf939aa1b25c72d5ab80dc2f12f6f0144e8c857637583977c3de2d1a5b0530d11f2043c9568646b1eb7c98199f6c99b760b79c368f
SSDEEP 192:CRg9MgTWv7mVvAPRp2h91Hsb+WNnsQPJtreEVyIsnAUgR:CRMMMiSV6Xy/wfPTR
TLSH
T14522952EBD20753B5CDBD22AF9217757E6F6112221D02E84EBFC4A6C26D75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cdb7b206e44118d50facf8eb004d83c085eeb2b4e7b0b7647c4ae1aa8c3cdd
MD5 63c5ee31c4af0b94436d5d99a211bd5f
SHA1 3a4a01d37bbd3bb4753c14f81efffc3208df2a87
SHA512 ad26c2a6736b51197df84db2f3c6788d7574734ca465321415d755541f9a4206875f3f4e1939fc3a7d57e5ba5d727ffcd890960a4a464a6aa722d8d1efe7edf9
SSDEEP 192:eeB4K6ga7KxkXqK4I40pUZNCgVLHrKHfFKslEdmQXzKD/Xe+ErUkKN9l9/B5P4L+:jBjva7KxkXqKf/pUZNCgVLH2Hfgsl5Q8
TLSH
T13532E927A48D9A7F4FD8D508D8176F8FACB502977268082467FB9D0803A57CA124E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 144bd9b747f9299e459cc9a35de1bace9a021f7d16c7cf42d021e8e3e4cb64bc
MD5 ffca1b777d5edb3cffcddd3c08743ed7
SHA1 7ce4cb4e5feb9eabcf0ef5628bc5daa1c51dd456
SHA512 ac3ff55ae42cf67e5ea789201a0933d20cb9fd93ded346d9b19835f50188ee42a5c5a71c875b36b34d6eee2c22643acafd7fa67214d431a5f7fdbb20a0e95b3d
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OgnpX6xVqmVummwk27:jeuvBnhJsueMEGvIW1DcP2OgBwVummnM
TLSH
T1D3D3764B3A743102EDE59A721CE050BB5E3CB16D4F55A5D4287620688EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1fc246fcf9d345f7348d3657702be8d5a324d7813e829870f02d32c1626f9b6e
MD5 c87dbf96b8b7f1c3dc45a3936ef210c9
SHA1 3e3c6f7335f40e8fb1252bcdd38d2bd5c96fa292
SHA512 be3e4b6fb2a857d6d4c7fd6f4be90855a2bed48210f33fd00d4c426d6242f697f484dfc45490c7847b250b4450e4d88029c7fae322a6004d5bbc22834426735e
SSDEEP 96:VejC6vd+KKiEfYGEgI8WfX+VuCRDotok5d7DwDB6oGyvQ2Ice7cbHfUv4a:UjCwe0GEg0XQDUDlYU5cUcbe
TLSH
T136A1F732A869493765B2D446B0036F13CFB872BBA5A19F94E9DC1F0C64A74EC0385533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 0fe6c46323cf88029cac1d57142a1ba4f7215a28bc21e08730c652883f176e6e
MD5 7f40eaf9c5cacb936b7a6a464c0bcf20
SHA1 fa2a09983e3dce45fb8a6b47a15a8b771233e38b
SHA512 c0a117c1713d92fdd0f2cf2c625f9bdfe83b2f0d932aa41aa0d8469322bbb742b0a6ebdccbfde5d7ade216a04e68ba9fba8f6e902aa880a0b928fdccdeee7ca4
SSDEEP 3072:+1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5C:Emg1kQfATCFbzQACjZ
TLSH
T1AEC3135B8AF409BE1702046261431EB5F7D6B77FCE522F9C936A07F666C7C861386423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 26a3e74695998ac483f8389ee4c41d261ef889a6f565900229784efa2bffe990
MD5 77cce3efcad53a16eec6a49a3793e987
SHA1 0b5b4459d86566790622a6f2aa2fe48dbbf3dfa5
SHA512 cd43a8a365b6d1cfd5126e20a93012ab10c387aa4591d9092e4759d376331d95ef62595f08e03a7e1efcbce84f8a9a544ceb7c6985c41bddc72e739548468116
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/x:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBL
TLSH
T166B29D5171BA2700383E280EA3B9841F5A46306230DEA96B3B6935E56F67F001FFD6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 d643f82a64f7078d29c78f3dc218488d2d2e223fde8c1daa718d78145f66f9ff
MD5 f5076b58c7d57e51c03229f5d3110b1b
SHA1 a6bb9c5ca56c8a54ce6e44652281e227d5fd8094
SHA512 26114fd82704c057f78262bbdc57569e2f49b541a22d05d1acc03fb500954d70b1b377aa6e97aa5678daba8dc679e1cc64bb7916536503d9bb63859af1b2643b
SSDEEP 384:DNrRZyCSDnxTICIBMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T18A44750A7B747001EDE6D9725CB080771E3C716DCF22A6916DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 33f804fc62a6fe4d71ea27184f4ef831b4120511748b8e3a3d24fa28c50ad275
MD5 42e0bd9689b3ae056a4f83bc9a6090c3
SHA1 2f1270a14e51a412240d9ffcc573a39832f82f92
SHA512 c6abef1f4c8ea6c358b200281f2ef54f8ce66da9c9e2b42be7e9623205a8a544f72d8545e801545473a82def27a3c08fa22e01253a818c8610c68ad759371086
SSDEEP 384:nOiF1tNn/s3n9Sv8Nq8TUNTUlIR90zvYoPOfosGnmvTDizyQKoUmn15wbAjEJ/8/:lF1j+9SHwgXvGmvTDieQKoUmn12bfJu
TLSH
T130C23A36E894CE77EDE78FC9B749761AEEE012A785D85AD4D9D80D4C01C329D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a876de8

Path C:\Users\Admin\AppData\Local\Temp\64177b92\6a876de8
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6180_1878984804\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5476-149-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-180-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-68-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-71-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-76-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-69-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-64-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-63-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-97-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-95-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-90-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-89-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-88-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-100-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-99-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-101-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-110-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-128-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-123-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-132-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-137-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-145-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-49-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-153-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-159-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-168-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-173-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-178-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-184-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-191-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-190-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-62-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-179-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-167-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-166-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-154-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-143-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-146-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-144-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-139-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-136-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-134-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-133-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-127-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-125-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-122-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-108-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-51-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-48-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-45-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-18-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-17-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-16-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-13-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-11-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-9-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-7-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-5-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-92-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5476-98-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download