7e059d5ddbb5dabe19abcdb0a9dda386c4e700cb8a8ec9275d03986fd5cc4aef

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Size 234KB
Sample260820-cfhvqaah85
SHA256 7e059d5ddbb5dabe19abcdb0a9dda386c4e700cb8a8ec9275d03986fd5cc4aef
MD5 0638f664e5c416002b4e18c0d9797f10
SHA1 eacd468a60939c6656301608cfa36c232af2351d
SHA512 18412591504e90c1182fa07c6df6d784bbd00580af8989ffd95e326a4fe2820bce6ae1d6819d8c72edb1feb8aa98391037ea6ddafbddb44bdf4313aa39a0d316
SSDEEP 3072:Qa0NB7H421XOQvG9w1mEx8alRShw0Cpx8Lvv2Rqm91+2pGQ2svdV1z8SS1N:T0NB7nROw19xPouXT91zWX
TLSH
T1F7348E59B7A50CF9EABB9539CD410905DA727C5647A0E6CF03A00BDB8F23AE09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5372	bcdedit.exe
3372	bcdedit.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemBoost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2596	cmd.exe
4596	cmd.exe
5960	cmd.exe
3120	cmd.exe
3340	cmd.exe
1276	cmd.exe
2900	cmd.exe
3324	cmd.exe
5076	cmd.exe
1600	cmd.exe
4152	cmd.exe
4168	cmd.exe
2072	cmd.exe
4860	cmd.exe
2808	cmd.exe
5932	cmd.exe
2780	cmd.exe
752	cmd.exe
108	cmd.exe
4172	cmd.exe
5860	cmd.exe
824	cmd.exe
2972	cmd.exe
5016	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
3972	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
3972	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
1696	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
1696	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4932	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4932	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
984	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
984	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
1448	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
1448	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4156	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
4156	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
2252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
2252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
5164	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
5164	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
7840	Process not Found
7884	Process not Found
7936	Process not Found
7944	Process not Found
7952	Process not Found
7960	Process not Found
7968	Process not Found
7976	Process not Found
7984	Process not Found
7996	Process not Found
8004	Process not Found
8012	Process not Found
8020	Process not Found
8028	Process not Found
8036	Process not Found
8044	Process not Found
8052	Process not Found
8060	Process not Found
8068	Process not Found
8076	Process not Found
8084	Process not Found
8100	Process not Found
8108	Process not Found
8116	Process not Found
8124	Process not Found
8132	Process not Found
8140	Process not Found
8148	Process not Found
8156	Process not Found
8164	Process not Found
8172	Process not Found
8180	Process not Found
8188	Process not Found
4104	Process not Found
5868	Process not Found
4432	Process not Found
3328	Process not Found
948	Process not Found
3916	Process not Found
4604	Process not Found
4368	Process not Found
5020	Process not Found
5568	Process not Found
2376	Process not Found
3408	Process not Found
5656	Process not Found
6616	Process not Found
3032	Process not Found
5068	Process not Found
4208	Process not Found
3000	Process not Found
3524	Process not Found
5044	Process not Found
5004	Process not Found
2524	Process not Found
6652	Process not Found
6708	Process not Found
812	Process not Found
6644	Process not Found
5556	Process not Found
4420	Process not Found
1784	Process not Found
1904	Process not Found
600	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4152	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	88
PID 4152 wrote to memory of 5372	4152	cmd.exe	91
PID 4252 wrote to memory of 4168	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	92
PID 4168 wrote to memory of 3372	4168	cmd.exe	95
PID 4252 wrote to memory of 2252	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	97
PID 4252 wrote to memory of 984	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	98
PID 4252 wrote to memory of 1696	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	99
PID 4252 wrote to memory of 1448	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	100
PID 4252 wrote to memory of 3972	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	101
PID 4792 wrote to memory of 108	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	102
PID 4252 wrote to memory of 2652	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	103
PID 4252 wrote to memory of 4156	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	104
PID 4252 wrote to memory of 5164	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	105
PID 4252 wrote to memory of 4932	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	106
PID 4252 wrote to memory of 3248	4252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	107
PID 984 wrote to memory of 2780	984	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	108
PID 2252 wrote to memory of 3324	2252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	109
PID 1696 wrote to memory of 5932	1696	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	111
PID 3972 wrote to memory of 5960	3972	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	112
PID 2652 wrote to memory of 2072	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	216
PID 3248 wrote to memory of 2900	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	114
PID 4932 wrote to memory of 1276	4932	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	115
PID 1448 wrote to memory of 3340	1448	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	116
PID 4156 wrote to memory of 2808	4156	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	227
PID 5164 wrote to memory of 4860	5164	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	217
PID 3972 wrote to memory of 2596	3972	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	129
PID 2652 wrote to memory of 3120	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	241
PID 984 wrote to memory of 5016	984	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	130
PID 4792 wrote to memory of 2972	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	131
PID 4932 wrote to memory of 5076	4932	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	140
PID 1696 wrote to memory of 824	1696	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	133
PID 1448 wrote to memory of 1600	1448	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	240
PID 3248 wrote to memory of 5860	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	135
PID 4156 wrote to memory of 4596	4156	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	137
PID 5164 wrote to memory of 4172	5164	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	136
PID 2252 wrote to memory of 752	2252	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	138
PID 4792 wrote to memory of 4176	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	152
PID 4792 wrote to memory of 4112	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	153
PID 4792 wrote to memory of 3348	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	154
PID 4792 wrote to memory of 4892	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	155
PID 4792 wrote to memory of 4620	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	156
PID 4792 wrote to memory of 476	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	157
PID 4792 wrote to memory of 1640	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	158
PID 4792 wrote to memory of 3580	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	159
PID 4792 wrote to memory of 4640	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	160
PID 4792 wrote to memory of 2156	4792	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	413
PID 2652 wrote to memory of 5972	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	162
PID 2652 wrote to memory of 5924	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	163
PID 2652 wrote to memory of 2472	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	164
PID 2652 wrote to memory of 1164	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	165
PID 2652 wrote to memory of 2996	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	166
PID 2652 wrote to memory of 3644	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	167
PID 2652 wrote to memory of 3744	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	168
PID 2652 wrote to memory of 3484	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	169
PID 2652 wrote to memory of 5100	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	170
PID 2652 wrote to memory of 5244	2652	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	171
PID 3248 wrote to memory of 3504	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	172
PID 3248 wrote to memory of 4568	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	173
PID 3248 wrote to memory of 920	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	174
PID 3248 wrote to memory of 3804	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	175
PID 3248 wrote to memory of 3844	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	176
PID 3248 wrote to memory of 5148	3248	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	177
PID 3972 wrote to memory of 4660	3972	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	178
PID 3972 wrote to memory of 4820	3972	2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe	179

C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set recoveryenabled NO
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3372
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5732
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5368
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2528
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5864
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:708
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5228
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:484
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5248
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5124
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4228
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1240
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5972
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5244
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6612
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6624
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6632
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6640
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6648
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6660
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6668
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6696
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:6704
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5392
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3556
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1788
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5900
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5096
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5860
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
    3⤵
    PID:4588

C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set recoveryenabled NO >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set bootstatuspolicy ignoreallfailures >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:476
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_0638f664e5c416002b4e18c0d9797f10_cobalt-strike_icedid_stealc.exe
  2⤵
  PID:2156

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000270;0000000000000274;
1⤵
PID:7252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:7552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:7556

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:7616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:7724

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000270;0000000000000274;
1⤵
PID:7732

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000270;0000000000000274;
1⤵
PID:7848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:7892

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000138 000000c8
1⤵
PID:2156

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000188 000000c8
1⤵
PID:6648

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000001ac 000000c8
1⤵
PID:2756

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000001b4 000000c8
1⤵
PID:6704

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000001ac 000000c8
1⤵
PID:3120

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f8 000000c8
1⤵
PID:3556

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000138 000000c8
1⤵
PID:6612

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000134 000000c8
1⤵
PID:4348

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 000000c8
1⤵
PID:6668

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000cc 000000c8
1⤵
PID:2340

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 000000c8
1⤵
PID:6640

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000fc 000000c8
1⤵
PID:5464

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000138 000000c8
1⤵
PID:6036

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 000000c8
1⤵
PID:6696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

junk_41.tmp

Path C:\Windows\Temp\junk_41.tmp
Size 285.0MB
SHA256 4bd0012ecc15992d5c137a7feca8f7acb4e759c80186ccc92f1abbeae0c6729a
MD5 d6ec8a79f390cd43f1b5c6cd47764aa0
SHA1 77979241ed0b7da43ac5a6ad5043ff11a4d2f7fb
SHA512 c6796ce1b273bce0465bdf54bdf78772e63a83429cfd03f772575d8061ae9bae6b2a51e7dcdbc356c821bfe1e60948845193b95e300fa803ceedc8fc5ffcadcd
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download