3fbf80ac2add3ca54ef3f297ea818fe30991f5fe3d00f8bb450efb109ac8e8e2

Analysis

max time kernel
140s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Size 582KB
Sample260729-a7m8eadb93
SHA256 3fbf80ac2add3ca54ef3f297ea818fe30991f5fe3d00f8bb450efb109ac8e8e2
MD5 82b5bfa2c6022050240006778413550a
SHA1 5b4d52053e7027c0ae4b76ebcd919690cba458bf
SHA512 9ccb5034ee44e5cc0c6a273eb2a989866fa5f2d2c67c83dbbc6911114bda73ecd4719288387c7cf44572d218204c0e6f4712a3b523020c9e248219c91a4177ac
SSDEEP 12288:bIG1uul2IVpQM5GpOTWgLYquY0ysYC0+vU3PFa1jEUDfaDH7MAdQm6DOC:Qul2IVRTZzJ+vwPujjfaDbMAdQmw
TLSH
T1F0C40246FBBA60F8D16385B885A54A52FB373A1207405F6F07A4C7367F126617E2AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 32 IoCs

description	pid	Process	procid_target
PID 4540 created 4236	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	99
PID 4540 created 5428	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	100
PID 4540 created 2796	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	102
PID 4540 created 5944	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	101
PID 4540 created 2664	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	103
PID 4540 created 5952	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	105
PID 4540 created 2144	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	106
PID 4540 created 4236	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	99
PID 4540 created 4236	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	99
PID 4540 created 5944	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	101
PID 4540 created 5944	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	101
PID 4540 created 3424	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	124
PID 4540 created 2336	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	125
PID 4540 created 4580	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	128
PID 4540 created 4060	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	126
PID 4540 created 1172	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	129
PID 4540 created 2636	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	131
PID 4540 created 5288	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	133
PID 4540 created 4424	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	132
PID 4540 created 3424	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	124
PID 4540 created 3424	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	124
PID 4540 created 4060	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	126
PID 4540 created 4060	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	126
PID 524 created 2280	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	146
PID 524 created 2336	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	147
PID 524 created 5984	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	148
PID 524 created 4768	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	149
PID 524 created 3804	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	150
PID 524 created 2520	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	152
PID 524 created 4056	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	153
PID 524 created 2280	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	146
PID 524 created 2280	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	146

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe"	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe"	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe"	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe"	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3424_1135379508\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1333844863\_locales\pt_PT\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5944	chrome.exe
4060	msedge.exe
4768	chrome.exe
5376	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297599221048499"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{F4A27A70-0776-42BF-B1C1-68E96D7E242D}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5312	schtasks.exe
2064	schtasks.exe
6056	schtasks.exe
1856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4236	chrome.exe
4236	chrome.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeDebugPrivilege	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
3424	msedge.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5312	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	89
PID 4540 wrote to memory of 2064	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	91
PID 524 wrote to memory of 6056	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	95
PID 524 wrote to memory of 1856	524	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	97
PID 4540 wrote to memory of 4236	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	99
PID 4236 wrote to memory of 5428	4236	chrome.exe	100
PID 4236 wrote to memory of 5944	4236	chrome.exe	101
PID 4236 wrote to memory of 2796	4236	chrome.exe	102
PID 4236 wrote to memory of 2796	4236	chrome.exe	102
PID 4236 wrote to memory of 2664	4236	chrome.exe	103
PID 4236 wrote to memory of 2664	4236	chrome.exe	103
PID 4236 wrote to memory of 5952	4236	chrome.exe	105
PID 4236 wrote to memory of 2144	4236	chrome.exe	106
PID 4236 wrote to memory of 5952	4236	chrome.exe	105
PID 4236 wrote to memory of 2144	4236	chrome.exe	106
PID 4236 wrote to memory of 5132	4236	chrome.exe	107
PID 4236 wrote to memory of 5132	4236	chrome.exe	107
PID 4236 wrote to memory of 928	4236	chrome.exe	109
PID 4236 wrote to memory of 4796	4236	chrome.exe	110
PID 4236 wrote to memory of 4796	4236	chrome.exe	110
PID 4236 wrote to memory of 5488	4236	chrome.exe	111
PID 4236 wrote to memory of 5488	4236	chrome.exe	111
PID 4236 wrote to memory of 1828	4236	chrome.exe	115
PID 4236 wrote to memory of 1856	4236	chrome.exe	116
PID 4236 wrote to memory of 4456	4236	chrome.exe	117
PID 4236 wrote to memory of 1828	4236	chrome.exe	115
PID 4236 wrote to memory of 1856	4236	chrome.exe	116
PID 4236 wrote to memory of 4456	4236	chrome.exe	117
PID 4236 wrote to memory of 2776	4236	chrome.exe	118
PID 4236 wrote to memory of 3440	4236	chrome.exe	119
PID 4236 wrote to memory of 2776	4236	chrome.exe	118
PID 4236 wrote to memory of 5396	4236	chrome.exe	120
PID 4236 wrote to memory of 3440	4236	chrome.exe	119
PID 4236 wrote to memory of 5396	4236	chrome.exe	120
PID 4236 wrote to memory of 5172	4236	chrome.exe	121
PID 4236 wrote to memory of 5172	4236	chrome.exe	121
PID 4236 wrote to memory of 2080	4236	chrome.exe	122
PID 4236 wrote to memory of 5256	4236	chrome.exe	123
PID 4236 wrote to memory of 2080	4236	chrome.exe	122
PID 4236 wrote to memory of 5256	4236	chrome.exe	123
PID 4540 wrote to memory of 3424	4540	2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe	124
PID 3424 wrote to memory of 2336	3424	msedge.exe	125
PID 3424 wrote to memory of 4060	3424	msedge.exe	126
PID 3424 wrote to memory of 4580	3424	msedge.exe	128
PID 3424 wrote to memory of 4580	3424	msedge.exe	128
PID 3424 wrote to memory of 4580	3424	msedge.exe	128
PID 3424 wrote to memory of 1172	3424	msedge.exe	129
PID 3424 wrote to memory of 1172	3424	msedge.exe	129
PID 3424 wrote to memory of 4556	3424	msedge.exe	130
PID 3424 wrote to memory of 2636	3424	msedge.exe	131
PID 3424 wrote to memory of 4556	3424	msedge.exe	130
PID 3424 wrote to memory of 4556	3424	msedge.exe	130
PID 3424 wrote to memory of 2636	3424	msedge.exe	131
PID 3424 wrote to memory of 2636	3424	msedge.exe	131
PID 3424 wrote to memory of 4424	3424	msedge.exe	132
PID 3424 wrote to memory of 5288	3424	msedge.exe	133
PID 3424 wrote to memory of 4424	3424	msedge.exe	132
PID 3424 wrote to memory of 4424	3424	msedge.exe	132
PID 3424 wrote to memory of 5288	3424	msedge.exe	133
PID 3424 wrote to memory of 5288	3424	msedge.exe	133
PID 3424 wrote to memory of 124	3424	msedge.exe	134
PID 3424 wrote to memory of 124	3424	msedge.exe	134
PID 3424 wrote to memory of 940	3424	msedge.exe	135
PID 3424 wrote to memory of 940	3424	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5947A9.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5312
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59472E.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffc1bd3c728,0x7ffc1bd3c734,0x7ffc1bd3c740
    3⤵
    PID:5428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,6283308332618855486,4829840934931697775,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,4063634964942543477,5674188255525897471,262144 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,10018300799365264554,1142692898360934359,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:13
    3⤵
    PID:2664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,18405424217528861604,18083874507748260901,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,558043883270574020,14312038340184607067,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,13724643397368087476,12581843623787201933,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,8571861694107064777,4976471974810750304,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5448,i,13728391679308610619,1137767872940042474,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,8449871616936077650,1889132092252019051,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:5488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,805776894546763471,11720170077876713411,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,15499212931614645903,8375135455888486832,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:1856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5736,i,9166431634956630645,5314674048052314948,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,1479730831148499048,6300754377311565916,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:2776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,13311743130935088723,11456130460377242722,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5480,i,5267287840536980344,9859080693821973265,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6048,i,5551396123476233105,7928588759753292528,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5904,i,6688857610465743991,2765360435052059384,2097152 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,6088340653525820472,12521749192977062478,524288 --field-trial-handle=1940,i,8341560485477511852,5440024065019679967,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffc10e3c188,0x7ffc10e3c194,0x7ffc10e3c1a0
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,7610185965323228250,11320539475279665656,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,9151543054911188013,17384521447333357106,262144 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,16292752620091670487,4474518984608975389,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,16922388791212899324,638187187849571726,2097152 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,12211464743507153844,14707968076541403359,2097152 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,14505560085827932165,12060035673105962832,2097152 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:9
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4020,i,4190823019668265249,7045281731278206517,2097152 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1680625540120578426,11421301881726868783,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,8814956300325194431,6747021954357280621,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,15681534502223368968,13882302631303340896,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,11064643645200026808,13451457845833761460,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,11064643645200026808,13451457845833761460,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,1299012904316629477,8647985606548876141,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,15147397118923691857,11376175271928499608,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,3133987381931388132,12219866768161784438,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,12520886575522675706,2321650198780996558,524288 --field-trial-handle=2304,i,577786370107250512,7523387982698285594,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
    3⤵
    PID:604

C:\Users\Admin\AppData\Local\Temp\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-28_82b5bfa2c6022050240006778413550a_cobalt-strike_icedid.exe
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59610A.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6056
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E596148.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc2ffbc728,0x7ffc2ffbc734,0x7ffc2ffbc740
    3⤵
    PID:2336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,9736907251301172128,33778660229218604,262144 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,1537716257935901149,8113100403177904390,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,14579946177504046820,14409237726326975388,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
    3⤵
    PID:3804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,12271471515812094279,1794641915241047280,2097152 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2996,i,15868841499304322146,16128616757915901436,2097152 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,8434154772041858727,6723673320431012271,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,14333286908822789898,7822611213651366382,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,13301205671091387474,712817130639580011,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:1088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,7601029982954291611,12195843833720164004,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
    3⤵
    PID:1696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,12905451877489205156,691653571403066710,524288 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5412,i,12275615267910141651,13631545196176203857,2097152 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4692,i,5712727328789722689,963057000501245037,2097152 --field-trial-handle=1924,i,11643286370007422742,16370345358280741312,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
    3⤵
    PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffc10c6c188,0x7ffc10c6c194,0x7ffc10c6c1a0
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1768,i,9059117889393033980,7095022253050954002,262144 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,6795645092509264687,660946259059954540,524288 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,10794626039398595850,4395839401282308991,524288 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,15949085959100848914,12904406954844374652,2097152 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,15775389376373068893,1547902370978769942,2097152 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,17496847865251252216,6283539302100934014,524288 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,1876371245723448851,6403382241298697314,524288 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8416150050730473308,15991544796392552926,524288 --field-trial-handle=2296,i,5490336988194154698,6021912551626129203,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:1956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 399fec45876641fe424603157c64a93bfa84a6d457c7744d232705c72323dae6
MD5 6c1d02cbaff738f3d6f94ec40dbcf008
SHA1 fbbd1bdb6411261370ed82572ad337196bd1b6e9
SHA512 8af560b1fdbb0124f20bafad9327711b7b9736fccee0686b5ff91af74ae58ea556cd2a9ec9178d8b558bb121c7cd6c068368dfb4df136801074042bef2e8fae4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 c7a6e26566883d1b30747039a8e0d44c1cd05ffdb96412024f1c0dbe3c1c0fcd
MD5 a0ba80ecd94f00cafec72b41e5a924c3
SHA1 0a1999dacc54ce6635a81aeba47dbd7fcaac738b
SHA512 84657685294c90a514df2d5396bcad57a9ee78ac68e2242f3a2f9551cb112bd9e2f8eee70d13f20a8c891e5bfc72da2baae1308db916b7b735d751b81bee5251
SSDEEP 192:vRTQ+3Nv7MvAPRp279gHsb+WNnS8PMC1akwwVyIsnAUgR:vRTQmtQ6XcqwJPKUR
TLSH
T1FB32B62EBD19687B6DDAD22AFE317753E7F5102261942E84EBFC8A2C10E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ceb1d94f473d2e30b4bde2980ea872994761c017d20844e488a8700e47974e1b
MD5 ca841cd7d30ee81faf1fa27749e327cc
SHA1 4c905aa14c4f77099f958f0b88fbb842ebf35fec
SHA512 6e870ff999c6cb7218f7bddbb784569d6fb554f83807d59759046024e79f898f60ce89bb37271661b995d239fd8815adaaf0d34727759528e971b87b7dfdd21b
SSDEEP 192:vRTQ+/kv7MvAPRp279gHsb+WNnS8PMC1akw1OVyIsnAUge:vRTQ2AQ6XcqwJPKVGe
TLSH
T14032C52EBD19697B6DDAD21AFE217793D7F5102261943E84EBFC8A2C14E75CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 264d4d5b4f1db9d8878945ade89889c7c7b77fd36cbe9cdc5211fa54017d2164
MD5 43cfd28fca372082fa82d37e6d7f8bf9
SHA1 6e30fc9eff6eae2ce62177d988456d7749a25c09
SHA512 0860002bf34b3c34244e3243afe513a72b3f4d30979b6b3f4b3f22515fb02a2b4779991e5e729a750f5b4cdb87a5711939d7cd972e9c738739cd2f3c2c5beba5
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9sjIAl53IM:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCh
TLSH
T19932E827A44D9A7B0FD8E44DDC136F8B6DF5419272780D24A2FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 1e1f041e764c1ce5b2620a3df39e0d420c43347d0fc0400347148975510a0776
MD5 c7c1ee9465df388e7c6088ea2061e5c9
SHA1 21b0b04593cbf8a8c778f292081134c7a97331ac
SHA512 b7398509ade19bc93fb81efff6d46f27a2383725ad832fdcfd3728df482c89acab689444b1cc93266f6e8bc2ea91f87cc28900d084c46e9bdfda2ce60f868ea4
TLSH
T1FEE0268526CFDDBD606580230630F30CA7E87409DADC39021F2CC6EC51C9C0CB3E5260
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13429759906063850

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13429759906063850
Size 1014B
SHA256 f1b0c1f995046a248e60e3341d13d7386cb7cf2570fb2b23a2b26cbb1ee32d2c
MD5 3a0f47aea86f1def5a5b9fcfbc4ce7ef
SHA1 2926b87c3b30bbfe1749357fc68e848c797a86ee
SHA512 a152e7da5023a2cf0f7952d9633dc220f96c2c24d774d1aa212b0809e93b6d6f4db683b193926059660e6ea41cbfdcdded6796883518097aa8d1faf9587b3b9d
TLSH
T18C11F42A76583939C2BF8A73C18689A2A1219E9116850C4FA1B0F674D9F739363D0DCC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 3c312bd4a03b3225c0d8b9f971e7ba4417610b08d578f5515ba92a1aaa7fc2dd
MD5 2988abd1f231e79ea249d15c2442a765
SHA1 9ace2cc0e6e88696fef4db7fdd9d9b7320dc2bf9
SHA512 f088df83d14a296e3779faf1f4f11820742bf6a6e0d5d89d8413e802cca06d635d203f7a5e1ae00d3a2ebf99bc3cd4f56b91ddf9fc79b7c078a35c2a57c54637
TLSH
T1DEE0206525DACF6F624A806B5334FB4CD5E17404D6FD15111F0DE1D8528D808B3D5650
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 7971a9b52e16dd9fe8b11bf585f0e2e29be1b6b36b1ab0a43d24aa7a5f51ed03
MD5 67741370b46114887d683b24ae782a4d
SHA1 ce03fbc633924146b57df8600dd610852358336c
SHA512 41c003d336f15a7927edd5518b6ce001344b360d45252527734b591913feba8e71cacab36e313cfb41de1b906ef3bfa46589430f2c39c86e00a6c4b8b358f94c
TLSH
T1D2E0267529DAEE7D644BC0274360FB1CD7F0780CD3EA36024B0D50A86184809F3F92E0
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a89c9f5dee3da8025caa816eda79bc71c54c4b73b3cc5ce62dd3c7b6e951d1ae
MD5 98a54fa3f1f403992fbec3699f67d814
SHA1 014cb0b62a839cd6380014a2285fe244e5a24e0d
SHA512 924fbffa5b8effe54dff410a586d404e0ddcaf96056437cb10edd34bf96b0d986cc7f02985fe183846a479217eb0fb42752d0cabdd2e49cc3e0cde046008f2eb
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OBpX6hDq6VumGOwwkWf:jeuvBnhJsueMEGvIW1DcP2OPgPVumGnw
TLSH
T1F1D3874B3A743002EDE5DE766CE0507B5D3CB16D8F56A5D428B620588EF2853A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 0250d369b89a72c4b2aae810c830036c745caf33baa2086356fab6a2bc90dfda
MD5 429a05637fbbf7316ac5735b6607f287
SHA1 a3adaca739cce7d806b57dc4aee472193748b3d7
SHA512 d39a3a34440a5f85e7e36e6d1c700f2adbf505a2c5464abf06528e56f865a6eabadbeb2b8437b3e147c4c904b7222be31e43f53782199bfac6f0421d44dcc17b
SSDEEP 3:YflllFNllv/etXlA5rTN/u+qg/G9EZtaXM/RuWGJpDEJ7KgJpDEJ7HBQar5UsuP:YN/UlA5rZzLWc/mLEJOgLEJLjrKsA
TLSH
T1F1022289A0800408C87A083EC7CFF9953A2A0F587FCA3A0230D001AA3C980064820B88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 25KB
SHA256 b293a0d858da1966a1a531f1ae759504131d60a6333eb1ae1b2146b89f13648f
MD5 83210615b34419c6eae92eeaab5c403c
SHA1 d80b669e4b2a08f633ae532610b5f2cc850be1a0
SHA512 ed1745458e46190d893bdbe8447dca2f0e3b1e6e3459d53def47b3f0225b4bea22be406f015e189b947e335fe3e260c33fc5bb030f738995c9871625935e297e
SSDEEP 768:gFEX3XZXIXjZiXjZYXjZ1MYyfXjZ1MYy0Tlq8Qrm:gU1QC
TLSH
T145C2C4D7B3B05B82DC9F97FBBC558C2E1777DC89859A0001A5A256BA3973F070C81399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 27841ed2a66609fe9daecda23bb79e87bc5788bc90a55ee99d60d12ef2396a1c
MD5 0771d0f95074e8518a466a206971a527
SHA1 c991623ffc3264d4344614661541ec0e6cda91a9
SHA512 d4f8330174e732fdff9bb44e9d40ea26c833147761e6c633ae46c2b77602930f243952fb1a7f2783391b8cd9288fff4ce0d28b02defe41abee1abfba17cbd041
TLSH
T12AE07D8D79CACEAF6058804B4131F30C97CC3809FAFC24060F09C0ACA08AC0CF7E0260
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ea9e9ce4c000a171c50f6cc82efb376cdde5a244e599f2aa4299dda91a95d805
MD5 de7470cf49c1a01e3d6069b95b0fd13b
SHA1 7a68b1066f08f02c0f681223b0e1a287d965ed25
SHA512 fb6e1abf09bc6ec6196361c0627c04f78b30a88b51e45874f190113755d2d2821fda8f9f87f84b2367e1dc17778c682f7aadcd10c7f0cbda519a36ff582d457a
TLSH
T18D212896F330C149D249973A147EAB250734D4569FF8FC0F01B620352EB2B240E4B6DA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 6dc050b0883853b80b9773e299c97792ffbf7d462a00c47698bb9211aeadd3d6
MD5 514dce4cb52e810de472b1a77b56342e
SHA1 7d83b713b9eac7829805c8f924a53e41cce02f77
SHA512 6a545c3e4ca3472f923f4e84bc7ed6a505e5ef868dc624cb46210961a3ce786f4bfaf66622ab4aed1af587a8af11a3bd4bba84e54e112272ee6e70765a402d47
TLSH
T14CE0268A788ACDAF405080570170F34C96D83808EAF92E020F09C9ACA18A809F7E5660
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 60b07680c72c7238abb7364abbd8f5cd73c9023162bb083e8485c87580c972eb
MD5 b1a55febdbc29d87be790daab0675fed
SHA1 09b84c82991e2f5f8ecb5b19d3849ed7f78649ba
SHA512 874a48a81ae381e66a5a57bd1b17157c7cf5550f2cf93cb10e4fb8f04ea20adb8a02846b1d17945ab37dbededec57c22d371e6664d1fd17df4ca0f213070e2ce
SSDEEP 96:xC6Ed+OI4Q2k7i/jfTVZ9gTzSl8h4otop5WZjDfB6pGyvX1f1I0jKHDTNhr40j9A:xCNG4DkG/FZ9oiU2YXppcfm1DTNhr4UA
TLSH
T152C11A71A97CDAB369F6C489F0432E438DA8616FA648AE28DAE94F0C11E74DD1343813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f4a29bb45ffaae67817bb63eb7429e06056fe542a27d315d7dda44c1e8297c03
MD5 8cedd7beaea86b67bc42cb17adf51d46
SHA1 18e588fd130bc260aca57413009b91003ff32b52
SHA512 5f68ae784a2bee2fd5560dbcea4fb545fe9223b7ec3a49f2911cf795669460988e68a514a03d3d68fe350e17077900bdda24970a94e854d3390e809b061be251
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5W6DfB6gGyvXNQrrbfyYv4a:RC0G4DkG/FZ9kGDUD5pMAQrrbfX
TLSH
T158A1E771A56D8EF769B2C448F5933A03CEA8A0ABA611AF44DDDD0E0C11FB1ED1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 a11008b90cf8fb76886a82503b8efae23684fe851f27338107e6013a8a7c88a3
MD5 d1891df38346ab417cf88a617e197b40
SHA1 87c2163ac0e8416ecc291da7e6e2a3dec5a23fd4
SHA512 1f52b215513e22729f203047baa3ee2158b12626935be4456fd6de694ac2cb45911db9c5c70f3affe9ca8e24d6be91bb927310dddd56cc1cf114ffa291cc11b1
SSDEEP 192:xC/G4DkG/FZ9oiU2Oppcfm1DzJ1u24URk6:xCu4DkI/oNufAz62Ha6
TLSH
T183D13B71BC7CDAF229F2C19AF04329438DA8616F9649EF24EAD90F0C01EB5DE1346522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 572729d926a6783c0ab03a2db5da75fa3e6a8370a9fd42f38d8dbfdc67fcc5df
MD5 53e40f91afe97622061ec3d409cace3b
SHA1 a65728b7185dd779a00d2f7133807359dc2525ec
SHA512 7040e43f18e1ab5729032fa23dceee9ddb7f5adefd46fa630dd581b2cbf9acb9aa81e60436d8e1c82af0f104d12eb091280153abd63550fb51846c1c998d3966
TLSH
T143D080747B555600C55D0071485067616262467034AF565550F3611CF5B489493BF595
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a852c109b9d422f92827d3e61593194d042a5449906c3d1a35f713e60711123a
MD5 e0fb8ff255aba67ce23958fc4441eb0f
SHA1 338ce0ce9ff190bb8daa87d31b54879d5bed5563
SHA512 50d8e09eefe25d7b6d15a91398e36397f926bba18a8918fbaca97b9c3d1785528c4edf9d35dc5d7b817322c31528b73251806a7816dfeea9a59ad40824a27571
SSDEEP 192:sxRPRJCm/fEsmPHFSaCzoA8pi/g6+WNIYbtZ6+tGQIgVKJ:sxRPKm/fEsmPlSaPi/5IK6kU
TLSH
T1DF32C7566A28A83B4CCBD21DFB557F53D6F92032A1D42A48F6FC9A0C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b91c29fcaefcf2f0fc05f8f3e1793e87161f49014e05e699dff53819c859387a
MD5 97403822f055d28112e65bae86938486
SHA1 692a1a64b77cbf6f85fa9e3fb7c3af5b4a8017ea
SHA512 cabf4046c2bc3d9d2b65262f6c3d7df12db7770b6d248382ffa22e2bdd80ad8465a6794d4622ac602ea3682ab084b46d427319c0a944ca603d42c9f8ddcf3de8
SSDEEP 768:Fb1poD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVqJ8IDroSSP:Fb1po1E7otWgikfq4u1jaNyIw7
TLSH
T112C2DA3B740CCB7F5F804ADDE819BE9B6D6802CB96D8CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c3233ea8d8d9b9c05aae546ff8475126dcdf1bc2dac9391e18857ee249fd7de3
MD5 0147a4eb22ba3f1d6cef129032eb6916
SHA1 c633cd01f9e491812bc8de104f6348589207f07a
SHA512 a9d089c7f07eac3001a31a2a6f0af5da53b851ed120937abee41fefa44019d3d396144c7f1a78fe7ca67c32b7540691ab070567579012522cdb27fc71a9f021d
SSDEEP 384:DNrRZyCSDnxTICrNjcqMEhIKyll7svbFKfk7:xFZJSDniQj6yI1l7svbF9
TLSH
T1AC44840A7B747001EDE6D9721CB080771E3CB16D8F22A6D16DA254694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d6b9d00d2677ccf40fbededc199582d353a2cc25d10f93b2b3af98932373e0f8
MD5 528c6557057c638e63c63ba55f1ce62b
SHA1 b8d24efd23be527481fe65141239a0d4c38baa43
SHA512 3dd73a0fe754fe0daee432227a331d2355844be52d5b9bcf779464280bcddba4f1183fc63c3f43b860b5dd14f9fb841d7ca145cbf1eb29d513ab08ba5c4a603e
SSDEEP 768:9rv+4UNbdC3oANBqobGfo9pZu4aWADIidy8Lq0eVH1S1C:9bsbw3b9pZzaNsuVLzEH1d
TLSH
T1A403BF36E859CA739CF79684B1877A0B7EF89163C6890AD084DD1F4E42DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60c01e106e97e0078d7ca0d95c185dbbe852e451b0a8805b38f7ba81912c5027
MD5 db80a88f0f92f2795051d73f04479aa0
SHA1 b8301966f335ae38d80469d090b545723845ddc3
SHA512 43ec1437179e9999246e39693bc52bea98d2afde4f0c13958f2133cebd7d8067e04f5ce8dccae66a5bd97fa6e5a6ff235f99db1b28d16cf789474faa4fa23e80
SSDEEP 768:wyrv+4UNbdC3o9cGBqobGfoRvn7tZu4aWADIidy8LuC9rD:9bsbw3E/R7tZzaNsuVL19/
TLSH
T1F303AE39F8599EB39DF69A84F1872A07BEF851A3C5C90AE4C8DD0B8E14C74AD1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83f7eaf4-7877-40c0-b531-0ce87e200b4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83f7eaf4-7877-40c0-b531-0ce87e200b4a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0924f697-aa52-4fc7-a11c-a96159841524.tmp

Path C:\Users\Admin\AppData\Local\Temp\0924f697-aa52-4fc7-a11c-a96159841524.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9aafd9d9-107e-4c1b-ae56-1c107f04b316.tmp

Path C:\Users\Admin\AppData\Local\Temp\9aafd9d9-107e-4c1b-ae56-1c107f04b316.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

bc97b0ff

Path C:\Users\Admin\AppData\Local\Temp\a8dff75b\bc97b0ff
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be812bef-53bc-4915-8c89-a575fffcd109.tmp

Path C:\Users\Admin\AppData\Local\Temp\be812bef-53bc-4915-8c89-a575fffcd109.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2280_39508450\CRX_INSTALL\images\icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2280_39508450\CRX_INSTALL\images\icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2280_39508450\CRX_INSTALL\manifest.json
Size 1KB
SHA256 49d9de983f7436ba786e6e04a5a20c10f41687ae06b266b1b6553f696719563d
MD5 6ca25f3ef585b63f01bcdf8635120704
SHA1 00c063811e31ea5f9a00f175a71ea25e7821f621
SHA512 566bfd9badbd8951ee52e5911eb68b51e86286989096d32de6e32a2523761b0e0afca251ef3bea36b5d51fb8354a5fca567772a02c3f3b9d8dfe529609fa0430
TLSH
T1CA118CD3A458C9732280D6D468A8B30BF372154F8C95BDDA777D000C5F8D4EB027A2AC
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3424_1610290397\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4236_1959542121\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E59472E.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E59472E.xml
Size 1KB
SHA256 47e057d3bf29a69628eafa8bc536343543d01a73a1a9da93cae25063b2822c5c
MD5 2071f119ea96a70683c3192381f01807
SHA1 bddc2b966ce4971c8b6160c59bec463926e036eb
SHA512 1212ff4d9c0eb073a8d2106f12a96eedf1b193971ac7f685098da01de1759af831cacdaff5b6867fb6b3111fae908558d1035ce7274671c759c4172cd12e6e9b
TLSH
T10731AD57ABFD161AF1F3ABACAAFA645299B6FC955D20D82C00B0060C0531D7199B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E5947A9.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E5947A9.xml
Size 1KB
SHA256 b7309564e345d891d5ead3475015d5ee5d1aff24130ab46accfa33dc6b9a02d1
MD5 56b86aa760f7416104d996764768f670
SHA1 305d3fb23c640aa04c2f8d02c8b0fe502d5f4563
SHA512 6895965e1f1e6f22d0d7fcf8c57aa7de20a0f58c80900464299429916d24db89983f02170016a2a92d8be8216db3b59c4083c9650b37048897bc724f8166f21a
TLSH
T101217C57A7FD220EF1F3AF9CAAB964529AB6FCA45C24D42D00B00A0C0531D71D9B1B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E596148.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E596148.xml
Size 1KB
SHA256 0deaff5db23230bb5059e3e15255c3bff7f48e133a8d03d8499837de30604c76
MD5 b7daa73a3a9206ba44ba2d3c6ce5c583
SHA1 540cd25c82f35911f40950d1ede595f5acc564fb
SHA512 f1c993f63f307f9df1d8ac0ae72fcaf4bc7d713c70f038794805c8a742abd7f6c8726bdc2f235f88d1a354b4d691f9b03e85dbc62b7a0ab2eb8e238ddd543219
TLSH
T1A331AD57ABFD161AF1F3ABACAEFA645299B6FC955D20D82C00B0060C053197199B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4540-63-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-69-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-138-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-140-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-142-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-144-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-146-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-148-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-152-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-149-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-157-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-156-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-131-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-123-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-132-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-126-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-130-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-129-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-124-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-119-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-121-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-117-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-116-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-115-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-113-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-109-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-106-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-98-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-100-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-70-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-71-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-133-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-68-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-67-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-66-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-65-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-64-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-62-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-61-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-60-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-59-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-58-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-57-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-7-0x0000024BA9400000-0x0000024BA9401000-memory.dmp

Download

memory/4540-17-0x0000024BA9510000-0x0000024BA9511000-memory.dmp

Download

memory/4540-18-0x0000024BA9520000-0x0000024BA9521000-memory.dmp

Download

memory/4540-4-0x0000024BA93D0000-0x0000024BA93D1000-memory.dmp

Download

memory/4540-5-0x0000024BA93E0000-0x0000024BA93E1000-memory.dmp

Download

memory/4540-8-0x0000024BA9410000-0x0000024BA9411000-memory.dmp

Download

memory/4540-9-0x0000024BA9420000-0x0000024BA9421000-memory.dmp

Download

memory/4540-10-0x0000024BA9430000-0x0000024BA9431000-memory.dmp

Download

memory/4540-11-0x0000024BA94A0000-0x0000024BA94A1000-memory.dmp

Download

memory/4540-12-0x0000024BA94C0000-0x0000024BA94C1000-memory.dmp

Download

memory/4540-13-0x0000024BA94D0000-0x0000024BA94D1000-memory.dmp

Download

memory/4540-15-0x0000024BA94F0000-0x0000024BA94F1000-memory.dmp

Download

memory/4540-16-0x0000024BA9500000-0x0000024BA9501000-memory.dmp

Download

memory/4540-14-0x0000024BA94E0000-0x0000024BA94E1000-memory.dmp

Download

memory/4540-19-0x0000024BA9640000-0x0000024BA9641000-memory.dmp

Download

memory/4540-20-0x0000024BA9650000-0x0000024BA9651000-memory.dmp

Download

memory/4540-21-0x0000024BA9660000-0x0000024BA9661000-memory.dmp

Download

memory/4540-22-0x0000024BA9670000-0x0000024BA9671000-memory.dmp

Download

memory/4540-24-0x00000001E0000000-0x00000001E0400000-memory.dmp

Download

memory/4540-23-0x0000024BA9680000-0x0000024BA9681000-memory.dmp

Download

memory/4540-6-0x0000024BA93F0000-0x0000024BA93F1000-memory.dmp

Download