eeeebef521d6494423c58354443a4f61f79ab962e61ecbd0add17869538154c7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Size 666KB
Sample261001-rm2czadh83
SHA256 eeeebef521d6494423c58354443a4f61f79ab962e61ecbd0add17869538154c7
MD5 5475db7bc6a9bc49a7293d52c0f21a7e
SHA1 3092712d0173eef0448d88eabb459ffdde46d496
SHA512 cdc6454f9272565aa5cb185018232dbea270cb9ec48de3439d9e9054f625b84c3e4a908316bd1713770be9e8b1f2f51a044db27b2c9a9fce9c7d67735e6d0fc2
SSDEEP 6144:UsLqdufVUNDa9A39ZqnRplUO83NxqIHDlSIesqScL734ZpVJDKkusdh+idzHjCo7:PFUNDaq39bhnc2rfrEshMW5az4qkoi
TLSH
T148E46C27AB9000FAE4B6D5B4C897491AFA717C1A0761AEDB13D09A162F733D1767E303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
6720	icacls.exe
6652	takeown.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
4296	icsys.icn.exe
4644	explorer.exe
4728	spoolsv.exe
2676	svchost.exe
4756	spoolsv.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6652	takeown.exe
6720	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1033471198\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_324671199\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1515149556\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1033471198\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_324671199\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 52 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1852	cmd.exe
2344	cmd.exe
3092	cmd.exe
5316	cmd.exe
2316	cmd.exe
2236	cmd.exe
2620	cmd.exe
5092	cmd.exe
4612	cmd.exe
1520	cmd.exe
4140	cmd.exe
1512	cmd.exe
4144	cmd.exe
2592	cmd.exe
4608	cmd.exe
1812	cmd.exe
3700	cmd.exe
5820	cmd.exe
3492	cmd.exe
5792	cmd.exe
1172	cmd.exe
592	cmd.exe
3044	cmd.exe
4364	cmd.exe
1908	cmd.exe
4580	cmd.exe
5948	cmd.exe
1476	cmd.exe
2000	cmd.exe
5960	cmd.exe
2608	cmd.exe
2836	cmd.exe
3420	cmd.exe
7148	cmd.exe
1220	cmd.exe
5552	cmd.exe
3132	cmd.exe
5592	cmd.exe
4652	cmd.exe
2012	cmd.exe
5660	cmd.exe
5140	cmd.exe
5724	cmd.exe
1940	cmd.exe
3204	cmd.exe
3776	cmd.exe
4184	cmd.exe
4896	cmd.exe
6916	cmd.exe
6072	cmd.exe
4804	cmd.exe
1764	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7148	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 39 IoCs

defense_evasion

pid	Process
4348	taskkill.exe
3480	taskkill.exe
820	taskkill.exe
3504	taskkill.exe
4120	taskkill.exe
4928	taskkill.exe
4236	taskkill.exe
1380	taskkill.exe
3404	taskkill.exe
5244	taskkill.exe
2804	taskkill.exe
5812	taskkill.exe
3360	taskkill.exe
2600	taskkill.exe
5300	taskkill.exe
2076	taskkill.exe
6048	taskkill.exe
1156	taskkill.exe
5704	taskkill.exe
5344	taskkill.exe
3884	taskkill.exe
1560	taskkill.exe
2144	taskkill.exe
1920	taskkill.exe
3380	taskkill.exe
3172	taskkill.exe
6076	taskkill.exe
1916	taskkill.exe
4104	taskkill.exe
7160	taskkill.exe
5824	taskkill.exe
4260	taskkill.exe
2780	taskkill.exe
2552	taskkill.exe
4384	taskkill.exe
692	taskkill.exe
2908	taskkill.exe
4532	taskkill.exe
5236	taskkill.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{0E82E9F7-A00F-4976-96AD-4F29260F068C}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4296	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4644	explorer.exe
2676	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	6076	taskkill.exe
Token: SeDebugPrivilege	3480	taskkill.exe
Token: SeDebugPrivilege	5824	taskkill.exe
Token: SeDebugPrivilege	820	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	692	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	1380	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	1920	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	5812	taskkill.exe
Token: SeDebugPrivilege	5344	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	5236	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	5300	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	7160	taskkill.exe
Token: SeTakeOwnershipPrivilege	6652	takeown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5148	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
4296	icsys.icn.exe
4296	icsys.icn.exe
4644	explorer.exe
4644	explorer.exe
4728	spoolsv.exe
4728	spoolsv.exe
2676	svchost.exe
2676	svchost.exe
4756	spoolsv.exe
4756	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5004	3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	90
PID 3356 wrote to memory of 4296	3356	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	92
PID 4296 wrote to memory of 4644	4296	icsys.icn.exe	93
PID 4644 wrote to memory of 4728	4644	explorer.exe	94
PID 4728 wrote to memory of 2676	4728	spoolsv.exe	95
PID 2676 wrote to memory of 4756	2676	svchost.exe	96
PID 5004 wrote to memory of 5140	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	99
PID 5140 wrote to memory of 5148	5140	cmd.exe	100
PID 5004 wrote to memory of 5316	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	101
PID 5148 wrote to memory of 244	5148	msedge.exe	102
PID 5316 wrote to memory of 2460	5316	cmd.exe	103
PID 5148 wrote to memory of 2612	5148	msedge.exe	104
PID 5148 wrote to memory of 4128	5148	msedge.exe	105
PID 5148 wrote to memory of 4128	5148	msedge.exe	105
PID 5148 wrote to memory of 4980	5148	msedge.exe	106
PID 5148 wrote to memory of 4980	5148	msedge.exe	106
PID 5148 wrote to memory of 4980	5148	msedge.exe	106
PID 5004 wrote to memory of 1220	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	108
PID 5148 wrote to memory of 620	5148	msedge.exe	109
PID 5148 wrote to memory of 620	5148	msedge.exe	109
PID 5148 wrote to memory of 620	5148	msedge.exe	109
PID 5148 wrote to memory of 808	5148	msedge.exe	110
PID 5148 wrote to memory of 808	5148	msedge.exe	110
PID 5148 wrote to memory of 808	5148	msedge.exe	110
PID 5148 wrote to memory of 1872	5148	msedge.exe	111
PID 5148 wrote to memory of 924	5148	msedge.exe	112
PID 5148 wrote to memory of 1872	5148	msedge.exe	111
PID 5148 wrote to memory of 1872	5148	msedge.exe	111
PID 5148 wrote to memory of 924	5148	msedge.exe	112
PID 5148 wrote to memory of 924	5148	msedge.exe	112
PID 5148 wrote to memory of 4528	5148	msedge.exe	113
PID 5148 wrote to memory of 4528	5148	msedge.exe	113
PID 5148 wrote to memory of 4528	5148	msedge.exe	113
PID 1220 wrote to memory of 4284	1220	cmd.exe	114
PID 5148 wrote to memory of 1696	5148	msedge.exe	116
PID 5148 wrote to memory of 1696	5148	msedge.exe	116
PID 5148 wrote to memory of 1696	5148	msedge.exe	116
PID 5004 wrote to memory of 2316	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	115
PID 5148 wrote to memory of 3248	5148	msedge.exe	118
PID 5148 wrote to memory of 3248	5148	msedge.exe	118
PID 5148 wrote to memory of 4308	5148	msedge.exe	119
PID 5148 wrote to memory of 4308	5148	msedge.exe	119
PID 5148 wrote to memory of 4308	5148	msedge.exe	119
PID 5148 wrote to memory of 1896	5148	msedge.exe	121
PID 5148 wrote to memory of 1896	5148	msedge.exe	121
PID 5148 wrote to memory of 1896	5148	msedge.exe	121
PID 5148 wrote to memory of 5024	5148	msedge.exe	120
PID 5148 wrote to memory of 5024	5148	msedge.exe	120
PID 5148 wrote to memory of 5024	5148	msedge.exe	120
PID 2316 wrote to memory of 5288	2316	cmd.exe	122
PID 5004 wrote to memory of 2000	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	123
PID 2000 wrote to memory of 2984	2000	cmd.exe	124
PID 5004 wrote to memory of 4144	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	125
PID 4144 wrote to memory of 3528	4144	cmd.exe	126
PID 5004 wrote to memory of 5092	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	127
PID 5092 wrote to memory of 4976	5092	cmd.exe	128
PID 5004 wrote to memory of 5552	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	129
PID 5552 wrote to memory of 4160	5552	cmd.exe	130
PID 5004 wrote to memory of 1172	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	131
PID 1172 wrote to memory of 5012	1172	cmd.exe	132
PID 5004 wrote to memory of 5960	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	133
PID 5148 wrote to memory of 3704	5148	msedge.exe	135
PID 5960 wrote to memory of 1760	5960	cmd.exe	136
PID 5004 wrote to memory of 5724	5004	2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe	137

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3592	attrib.exe
1128	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356
- \??\c:\users\admin\appdata\local\temp\2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
  c:\users\admin\appdata\local\temp\2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x348,0x7ffdc42fc188,0x7ffdc42fc194,0x7ffdc42fc1a0
        5⤵
        
        PID:244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14909458969712687678,12714337988923899646,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11755366832817866383,9368332185336735033,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2614876594978549378,3004522420750294686,262144 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:2
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,12186454422967158816,9600118200217367427,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
        5⤵
        
        PID:620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,8422912242282655921,11489696819121259958,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
        5⤵
        
        PID:808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,17530003482616631450,8823699484240463947,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
        5⤵
        
        PID:1872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,11854208599867355744,8946475840393518840,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
        5⤵
        
        PID:924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4452,i,13532169657855264918,1058613267412542593,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
        5⤵
        
        PID:4528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3848,i,2772648277298153817,15065345432559174012,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
        5⤵
        
        PID:1696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,181618950815845929,1557810705588738849,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
        5⤵
        
        PID:3248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5844,i,1269360563052943946,10360091898464309656,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
        5⤵
        
        PID:4308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5884,i,1479854546499328941,6261285785570562432,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5980,i,18403732283264498046,11357128246272182053,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        5⤵
        
        PID:1896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,5112534721655944878,14069253525976328688,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,5112534721655944878,14069253525976328688,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=1608,i,7366371938274851060,15352644475145508400,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
        5⤵
        
        PID:920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,13574518417717107059,151651532146550854,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
        5⤵
        
        PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,3095196309883611721,1037262524606700315,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
        5⤵
        
        PID:4412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6388,i,6704666233287049310,4930719102360718271,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
        5⤵
        
        PID:3876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6428,i,15142933867842096875,7162755802918364856,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6520,i,16909538698619110776,5776467845276873848,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6704,i,719048367108357867,11303209028605305521,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
        5⤵
        
        PID:5232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6836,i,2075820519403141527,10908384737738437111,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6684,i,1416121814319691736,10282408664757096057,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
        5⤵
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7160,i,15771714939930798037,6603670845027896650,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
        5⤵
        
        PID:4280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7092,i,10244755860576029431,14461414511209617328,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
        5⤵
        
        PID:1060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6956,i,870391766593174721,13335968135886029440,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        5⤵
        
        PID:2500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6572,i,1587690234774731685,18100775843100572120,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        5⤵
        
        PID:5992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,8493454241403754190,7390388528026847424,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7164,i,1203169322224485110,5840623349780692751,2097152 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9052,i,13965242479675436,15304483467150171980,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:14
        5⤵
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,601494828056755467,11276639264367796566,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:14
        5⤵
        
        PID:6768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,8640617232226088739,7370153956382314191,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
        5⤵
        
        PID:6776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,14698573402434842581,3676073113958285241,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
        5⤵
        
        PID:6784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9084,i,12197329948156406363,16959941579201936357,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=9032 /prefetch:14
        5⤵
        
        PID:6264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,6712509707521830984,1336899603372011514,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
        5⤵
        
        PID:4600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,913054436538512513,13830880481768409110,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:14
        5⤵
        
        PID:2056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4300,i,13275475795454642860,3476704196360031897,262144 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:10
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,1075764654689179168,12143474235411498976,524288 --field-trial-handle=2996,i,1376779945085650860,14402300734304496777,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:14
        5⤵
        
        PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
      4⤵
      PID:2460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
      4⤵
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
      4⤵
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
      4⤵
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
      4⤵
      PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
      4⤵
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/xsu527pe?key=5cfd72bea2199ce3a23515a135906edc
      4⤵
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/mbsbtt9mw?key=e3e8c9b7dc92fcb988a1025a2e252cbb
      4⤵
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
    3⤵
    - Executes a command shell one-liner
    PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/pxtj5fq0?key=cadf533f865ee25010f8b903b31f90cc
      4⤵
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
    3⤵
    - Executes a command shell one-liner
    PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sneakinghalfbakedcucumber.com/cuif3brw?key=7afc8c15c2212a59369a68ca83ee78f9
      4⤵
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im gameoverlayui.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im nvcontainer.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im RadeonSoftware.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3132
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AMDRSServ.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im amdow.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AMDRSSrcExt.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GamePanel.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im bcastdvr.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GameBarFTServer.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im RTSS.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4364
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSIAfterburner.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1812
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Medal.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MedalEncoder.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MServer.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im squirrel.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im elevate.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im crashpad_handler.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3700
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im inject-helper32.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im inject-helper64.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ffmpeg.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ffprobe.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mp4info.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ThumbnailGenerator.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ICYMICreator.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Overwolf.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfLauncher.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfBrowser.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfHelper.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfHelper64.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ow-obs.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ow-overlay.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfUpdater.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3492
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfCrashHandler.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfBenchmarking.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OWCleanup.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OWUninstaller.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OWUninstallMenu.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfLauncherProxy.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7148
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:7160
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCU\SOFTWARE\MyCheat" /f
    3⤵
    PID:6164
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
    3⤵
    PID:6192
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
    3⤵
    PID:6240
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
    3⤵
    PID:2428
- - C:\Windows\SYSTEM32\attrib.exe
    attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
    3⤵
    - Views/modifies file attributes
    PID:3592
- - C:\Windows\SYSTEM32\attrib.exe
    attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
    3⤵
    - Views/modifies file attributes
    PID:1128
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:6652
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - Executes a command shell one-liner
    PID:6916
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4296
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4728
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

361620a6-29dd-4a85-9afc-2794b726bb7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\361620a6-29dd-4a85-9afc-2794b726bb7c.tmp
Size 11KB
SHA256 15ccefb1f12428f3da9791753798e65652295b792547e707d18fde4a2e6f53bf
MD5 1707da9cc8a56e77d664c4e3fb16bac7
SHA1 3e228bf62626ed87718a5389a658653af0bb8d15
SHA512 9f5c87e5596391b43ff522ab92093e3756552be7091f04425c1363310114cb8fb7b7d1045c29bba56b827d61d29fc4111d46eb18dfa7fc36501f07793e919160
SSDEEP 192:sxRfRiCq/fJs29EioEmzoA8pvTQ/g6+WN9qxZYttYGTIgVRJ:sxRffq/fJs29P90/5+ZOF
TLSH
T12942C859AD38A97B8CCBD21DFB657F53D2F96032A0D11E4CA6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 48KB
SHA256 ebaa84c40eb09ad99eb8e9facd1a325edc1a8110a276ccb810a70741971e0762
MD5 08eb9a6605954d53695caf4e9b13ceca
SHA1 be79d448d5b716d869446247688023057c52cb2a
SHA512 da8e9c15abd70130b1bb990c17095f90c4071c5e8087bf891a56285785d635189d8c70085da045f1cd5a6948b483104bc1aed701d7e0810afae4adad9070ccfa
SSDEEP 768:3GQ5Jxd+6wi1CWe4cgV4Yrb9IQS11WAFg1ZAjQtImc1vuepVD2YHEB1g74+1wD2E:3GPt4cEVS1KZ/Kmco8VJygc+1RTy
TLSH
T16723022B25BE9004BE936876AC12418E4448C74723E969C655E7BD6CABEEC81D0E7DC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 34KB
SHA256 5b61bbe441f0ec871ad09d168a8fd09afe8e093840d7c4536d09f6d1372c981f
MD5 2670c29f0f8fa13d0155c4f1ff8198d8
SHA1 5cc96b5b7c5aa2d9f7cdf04a6a8f686b5b62aa54
SHA512 8572f455384eb016aeb379eaf6e89ec7dc9a92936bc9e28bd22cfc941fbcd54dc79fc0a9aa67cbf5c2a2307be179b8f192f7d60d10bde60502f8e9a601f5d263
SSDEEP 768:GEQ3iS0L0nxEKFF3F6fH21FSFNFQkFFFODg:A3iS0AnxpFofW1FSzPjgE
TLSH
T150F211876B7B07497967A0113BAF46806655D003D04EDDD93FBC29488FC22E2F5EA78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 19KB
SHA256 e3eb64df7aa158259b60b92315938e0fde1cb2eb8445cfbda2130061c94bf80b
MD5 31a8ecbdd5a1ff11921fd65d9220af55
SHA1 7cef24d6c614ff6535d294ac0b7fa33c4ab7c202
SHA512 7efc1ff32bd5f7cb60b3bb675bcc2d9c19cc274856fe1bac012b42f57e6cdd63efbd6158acf00a59012c4398c4035f330ccb83ba898f8e0d0de29b7016ff4942
SSDEEP 384:eraUn0XzgOS6dA+C4Mnk8yPoUqta9bL4JzhIPP5eZxgTIbKv7KUTi/W3O+3KB+oH:eb0q42s9gJGPP5eZSxzZi89orEXU
TLSH
T1A792AE48F917DC3221593ED4F1CE907379B717C2AA81E980DCEA9C37561137C886FA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 70KB
SHA256 71600fe52cfd497750498ab6e18a59621a18face7e0bd8d9200ff0b00247ea77
MD5 12e3cc02ed07b2bf20a426d810d4e66b
SHA1 e283fcb25218721244f69586f5ed00600fb2b0ac
SHA512 4352ee8a38542b52403a50f97f63782df96740ffb6577617c6b558a5e8bbce3cfe232bff4a01675ab656e9c271b4b6c50dac65e219eae3f0c7fc6ef058ff0c42
SSDEEP 1536:epLa2ttOOv9QdjTzTOIIjKVF1peD/7oU3i2Mv:eBa2tMOv9QBYeVXaTM
TLSH
T1DC63F14DE2F20D42DEE8AA6B4BC244B6573AFAA3DB194B1C2406356C3D5487E138C75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 48KB
SHA256 7bc5641fb996c0e8d68dea1464818f9b5de9907d7a189cd5a65c7fc64dfd41d5
MD5 8d4e1e04075013d183690997f7bddcc6
SHA1 ee8950d4d1f49d1fa8a1bd616bdd614c80418318
SHA512 16f36c7693e502a430cec80d9d833a483ff006001ef718159e5c7c2eebc48445e245d8a50941c412d2caefaad1ef998dae13ed1502b92f8b4c02027a0b43636f
SSDEEP 1536:t7oPCR+tHhMrrp+MC9k9tpai47TLOI+FLpy:SBMrrp+MC9k9CiImI+FQ
TLSH
T14D23E02DE1F2D5090D8F172B2E7551992F3319130941E8BC6DFEF58ED8192BDAE120AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 30KB
SHA256 4315145bceded050fcb507a468a797fca6d5187f37cce7698949d1905a01c2b9
MD5 7a39454a98158fefa4a3a80a5752ff69
SHA1 99264fa55ccecc48e209700112f247c0f1c1f838
SHA512 851029e356a6e5a2c651fe3e4c3400ff84f0a09832af133000b2e1f053fe93ff5ed8c57585fc81a3b89557b30df8e7205d2fa45499ecfca44c845957f192245f
SSDEEP 768:ePRW2rGPjaIPyPObfmrmPWSXWxGSWKW7f05VUPtXD:g9iPOIPyyzXs1xW785VOD
TLSH
T1D2D2E1C53033E6001577A0B120643B17515782ACE8E4FA79D5DAE44EBBDDFE0B818A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 29KB
SHA256 c6921cb7b464bec4904d4d4955482dc5acde10220bd46d6e3aaa1886cc66c882
MD5 e388114d5f105ac9437d730e5bd0b83b
SHA1 a979a682e51e482b988ea2647ecd5b312c96f009
SHA512 f06a9277d53e0db5c7c0d605f1c623f1c4c8211a38de4d82acc8e020ca07501401754ad0a35a7378dafb4cac1fb2ef3b5a657e1993ee387f332bba681a653e45
SSDEEP 768:PpLHOOjDd1NpCxEmMXG8fzLdh4q/RiHbi0f:PpDZd1jFmMW8ndLRiHbi0f
TLSH
T155D2E19BC4B3D5514A835B3664D00F1753EB2AA14AC8A727DFA4E27D2F48DF0345E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 30KB
SHA256 21fc492b88a1c42a9713c22626d9a3eaccff15d85de0c48d23f9d5680f23ac75
MD5 686a53e6a64af08aa87ac37a83a296ef
SHA1 38fadb8e09a66df472ed2e3c522c1580dfbd240d
SHA512 fdfe950d5bbda6fe5d5b415eb89dafb8c3ffb3dfd8ec92bb990610f50ea4ad4c8b3fa9ca11e2c4f7709fa9d4a2ea365f8676513489fa84ba50049f743268e60b
SSDEEP 768:UZQ5Ajx7trTdY7GCnAuEvy1XmZiQKCgR3nFde:UK5Wx7hTdY7GCA3q1WZix3R3F8
TLSH
T19FD2DFE0C503D4289EAFA7553CF8567F0AB793C998C1137095FB8BCDC97526A50A834E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 43KB
SHA256 caf2f0db1db56e1272842544d45426785509f0d1b53e69b1fec45cb6a129ecd8
MD5 563137209c030cbc30262684c174cadf
SHA1 e6b1d9f79b646f56f1dad6d6beececa90946d074
SHA512 35ae0e76839f3b52e79d90376e520a034be193e77c212e6199b2b3058263c1b64f3c06ec4ab781b1c544663876f07f7a8b0cdcd2550cdf3f03b9605cb933c3ee
SSDEEP 768:UGUBNr2Pjqe28qFkEHRrH4VtLdUQdyI9tSWKETMXrRKipEq/LYoNR:U72+NHRkVtLiQJ9t7KLMFq/LN/
TLSH
T1FD13D0EED0F6E4276DA64BBB44B9CD084B3113B381D919DD94E436850E2213FD74899F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 25KB
SHA256 5d08fadf4fe03380e5a65387c96352606b938cb99b005a704a1eb1f2e9233023
MD5 bc6b9fdc0edfa8a0cd01bc432df64a53
SHA1 97d5d5853ac7c308bd1009c76114bba21069172e
SHA512 6e4a7913a218dc6690b103deb42c651c81003655e1c2c1c08a8d4056e7c8b01304bea4b439ebdcfd1bea537b2545d03c4ed587764e740163fe8df8d6818de0e9
SSDEEP 384:VmnV3PPARly8xq88oCC4chIjfSOlyNu+ITpGSBaGDY8vA9MGHRSdbLxQ3AO:oFARI805JjaBNu+IFjBNq9MGxiLxQ3AO
TLSH
T14EC2D045F9B3EC518D17B888F04199B93C63CF909A1094B06EDC6D9DCD03EF64DA1A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 214KB
SHA256 c4bf0666132b375a185310fa407d5bd8a4657a409ed76d6d708e4eccd8f8b55c
MD5 a604cfa5b7b5da3b02cbea2f631e42bf
SHA1 8c4431f42e1c46da5fcf0e2cc86345c65e95d5c4
SHA512 2aad93994515d4baf7b5e9225e1ef1a0c3f3e9b38760ed98a33a3ca40cc117fa436aef38638583f75585764400676bb6278ae15c55ed2b9dd778877e18b44975
SSDEEP 6144:bbfyaO/Rkid+OWpZms/OVljnhpTgmFaoH55pZxz8vmKOr9lXAfNN:bLT4RkioOyxmVhzooHJD8HORJAVN
TLSH
T1AF241277C9B801962D1BFEB8FD467E4AA3BA24D45E15AB3F00F1BC12574193C5B2C60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 191KB
SHA256 e563e7fd4cc48ec03b3829eaaab5d89b86b308657f7da6239af55d44df27a1cf
MD5 02db30f8280fc78a7d42ac1208a5153c
SHA1 ede5b86919aa520dcb483129e571375b7d083a23
SHA512 b6025048ddde9a0df4fcb43ac11f36e2116a3339520376cdd2a5a376a47f94f14f76d301b057fd8543900eced84bfc166b2564812f7ca8ec23aaf8415615a2af
SSDEEP 3072:UFdcfxoKfBkC0YoyV6FRo0BWpE9DawjFwlTh+EqoGIcVJWmyeyr2Rs1XQgzZ48gd:UF+tANBbmwpwlF+E8On6eZPgd
TLSH
T1531423F7935347B19E51543B0268EB8994F01AC0AC75817C1ACA762BB423035FEF99EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 32KB
SHA256 9e6000f3d488b5d8ae9f079ab412fce6c797b27a4db06151974964433879196f
MD5 6b0973e2682af1fab3443fff6bf6655a
SHA1 90f31a1accc2b2ae9544de2040233aaee8367747
SHA512 9c1155664e6e09a22fbcf5b21d0d284b101d0064cc54afed313c116fae77c9e3d1208ab8f5800e7f8ef10f4bbc014295f93e37277bd20dc443edbb7702f7208e
SSDEEP 768:eo8xgwpmFfPYnmVH5D4uQDOEWJOxa6EYvNT6LLIyYAlgh2C:eZAfOal9QDOtAEwkLvYBD
TLSH
T101E2E161B6D2E203B549B2C32470CF15DF05041463B6FC3130268AAB9F5672F3F9A6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 16KB
SHA256 bcca4c24c9e0b1048288c40dd652c22fc0ebc2bd3482447fcd2d58bc8888a5e4
MD5 670c67ddb5193e3462ccdd265433c2cd
SHA1 228eb10c70b84b99ddf1de1882199473d405ef96
SHA512 cb46e5452b9a15a41430c4dbd75b584b5321a5590c980ece51f349e1b0859735393d8c68c5282d07b21caa09cbbe5c701b761b8ebaab13d4ea736648ad7bb717
SSDEEP 384:+ffLU/KFiCPtjwZ5dnhA099o3mGY3rJZ8U8cXDYGL:An7F8tl99o3mhnXDhL
TLSH
T1FE72D06985A2C122F2DED704A4F35203885395C3FE646937B4CFD38D88A035EAFB4985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 73KB
SHA256 47ac7bbb85fd3bc199bb815e120e72e6a8c58be8222b3d1f7e9d0b218fd1a60a
MD5 6e60ef8dbdfdaa965033c1ce25e0b818
SHA1 1cb6dd47ff231398a3cf8520152bdf0bc1710a87
SHA512 ddbec116d38832e1de57ec4c41fe70d30f344cdce3ddace3a8671c503e423ee2d7f1350bed871586c6c67949598a31b279bbb1b1eb45c9d921136480ce0d5ceb
SSDEEP 1536:F54thP0EdBMigucEWysGDfBFc/7I86ohewMd:FCzguRKGbBw7beH
TLSH
T15B730265B4633CE8FD50A3FC0AF373A912343DD161B7839A62BB95D04B21E76964CA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

352f9f0f571e745a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\352f9f0f571e745a_0
Size 3KB
SHA256 bcee5acc0d5dc489873b64d854a9f1e540feb02dd2ea6e7bfebb076506b24bc1
MD5 12c85696123d9e83f9bdf0711e187780
SHA1 5f44895a416f56b27b8eeaa6ca1ee510cb50fec9
SHA512 ae48e84da40bed24c4bcc13026d1bcbb3ae59be30032b49e87da06ee5a45799d61b7e40870174a26c3b0cbe643d83e9dd6c1d8e0f7419e939dbd659bb67d0fc5
TLSH
T14381B5C3E7501A0EDE2B53F749C25A525770A2543B92C32E94F293683C613F78D9A6C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7eed422b0ec420d5583705ff31c4c1d5537c98c352e95754ca28348b4015c15
MD5 bc61f5caf14aa5b4a278b50d5d552885
SHA1 b3993058f0b27930587a86aa7cf032eb0eaf5320
SHA512 a8c480f7be364eb6d6fc3646b759cab0f1c9571233b57cfac91fd2232925a4254feaac5421a0d222c7b90f91707e152f600e779999417beb94a11442555f1fb6
TLSH
T11E61A342D472429CF7EA447E8DC07CD73B30E68098830E71B5D8C97AEE96325D9DA06C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599a33.TMP
Size 3KB
SHA256 281c44b0b9aed19a501a66e2ffa4ade1f7e4b4ac6d0032dda95ba7131c16ab96
MD5 23071f8a0f078fd189d68380ac3ff19d
SHA1 dae210e98a738c60d28177f97a71bc08cf19ddc3
SHA512 741aa8dccaa35ba7cf5eb7d3aa2fea7b5b9faed2a168aa04d2ec128f77a94089f10788f1d50ef7bdee1e229593ef1f98181da49ab464a5350a60d6ed168933fc
TLSH
T133619442D172428CF7EA447E8DC17CD73B30E68498830E71B5D8C97AEE92325D9DA06C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bfbce998ce68c1f7f532979c771f721b72b36bc49a53fad3e8462b914dcbf041
MD5 ef5696f33c5b72654db307b0386fae90
SHA1 6b05aa6d435a45a5d5d8fd3acfdb36b2e6c8e5e6
SHA512 bb9cfa9ff85b04a3eede156c9deb07c0d50691bab6eddd0c8e2550386a991a582fa35079b3f0e2d383cf3e1972389de1b9dc1a570494303f6c2c04abfdc98e3c
TLSH
T1B871C1F7C3E8866DCC1196F0A714AE2BCE2D0924532C3D5AC9D8EF5B93E2471D141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2e11959d85f904f9b033c628e8d053fa9512ecd9a532b8a07589a37c83f355f9
MD5 a98b675dea2c19f2c5990c1bba9b7315
SHA1 ea3eb8f66974d06502ec8e4fea212fd11552e70c
SHA512 55b5dca5d7d3157ecc4690f2e676daf094fdea7d9fe5e7935b4ea4dd74abcefc23eeb25fb2dadaad0af4480851b916a2103e5fd1f1bb6e905c6064927b5e4d2f
SSDEEP 192:sxRMRiCq/fJsoyEZOczoA8pvTH8/g6+WN9axyq5pYtoYGTIgDxRJ:sxRMfq/fJsoy6ONA/5WFpPF
TLSH
T14F42C85AAD38697B8CC7D21DBB55BF93E2F96032A0951E4CA7FC861C14E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b16a4903473fc1247d650ace8f51cb6cfe85d080cee457f5c4ba407a6ddd123e
MD5 603b328bcb0a20ed1db81ffc4aefedd9
SHA1 93fe3614e0f87022894b59b82a4cf82885187ffe
SHA512 682b4265677b6f6d61e21f4f0fc0e88bb269e583401b60f7cc669a7414bac433635ccf915d1c1d91c2ddbd49c038ab449ae0d0265c049b2598858bbbc7a4916f
SSDEEP 192:sxRMRiCq/fJso9EZOczoA8pvTH8/g6+WN9axyq5pYttYGTIgDTRJ:sxRMfq/fJso96ONA/5WFpSr
TLSH
T1D742C85AAD38697B8CC7D21DBB55BF93D2F96032A0D41E4CA6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 42ee7796df226cd4c219369257b593e640661b26026e43f30d62736ad8036b64
MD5 8bae16e5c185ae36d400e81f6e0c46b5
SHA1 426ae89087c56a851e8eda42c59277305de3a178
SHA512 657462aa4d46207ba1ba07b13f11e7c4911a961edb92f8a86efd06888eb6b997964baf5935daf3aacf736ceae5351f3180ed98077769d8db2d26ef28df80e2b8
SSDEEP 768:dmGxmF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OV/UGeNromLesgU:dmGxmTEb1sWgmMfk6u1jacVemy
TLSH
T1E3C2CA7B740C8B7F4FC00ADDAD197A9B6DA802CB9698CD8447F9941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 77349120ef8b4489723e979421c6d4250f6cd874bb2fa24c9267c78e9cc01923
MD5 1f7901808f6ea418f55a03937c78d0a6
SHA1 bfd18d08fc57d6e882d91d151659e912e2a31f20
SHA512 e9d669836d0adfa95d4fbe56cd97b181db1b549b06e092fb7101b4ca075523eae8fd0cc4254f07cc05823e660e64603aa292b1e95fa7582c813790f257e3f119
SSDEEP 48:KMyN4syo4ZTcr0Ia0ZKVw9CZRKJozE4qyDmhEAucc9TYvwIao9KV89O9RWtoX4ct:KIJmKqUqGdSK2YBmz6KQQE
TLSH
T1A3915960713B4210387D3508B1E5ABAE538277A33174E62B7BEA40D78E66D484DFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f1b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f1b9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 23775a9b0b2442ad7927443755e8f0c77cf3f5c55db54b87c9147b37edd36bb3
MD5 a32932d2328a18a9e6cc4495b819986b
SHA1 b9cd422dc76957cb83f283befc215be8ab357dbd
SHA512 6c8a13f7f165931bbc33365cebbf8613bf35b3ab47f299c46e2a9b223dc52b9b7181a0d7b34aec17d6fe4f53b1213b5859902485b4d2dcbf176735a9986a957e
SSDEEP 768:0/UxvxjgC+U3uRKnJOtlxDc9bsMSJz/Fn/7SHXPyKQ:hZj3+U39UVQbs7JTJSbQ
TLSH
T10703C075AC505C63CDE7A780798BB687BFF41593C8C5299899DEAE0C06873AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 629fbbdba046c8b1c489cb376f94964cca1e060376fc18ae661d9c0f42b4c81e
MD5 25f5642ecb832803354c8a449c565a33
SHA1 f89e3f8bc1f22cdf58968bb1d425dd74b8fdc7af
SHA512 a972caa95ace777d6ee6aebaaeda02a61a6984978cee5cc0916f0a5c85c2934e72dc014257c3b9e83134c3cf4ac6c129d04b44df51d1e9e588182d465782c7de
SSDEEP 768:UFQF3owgXFC0nJOtixDc9bsMSJz/Fn/74YGHB0:3F3ABLVQbs7JTJ4YUB0
TLSH
T1A11349F288D38977D8AE5783A77D6E46AAFCC053B5885884B7C95D0CCC822BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fd8113cb60cfa86f22fe60083334ae471d6d84ff05f14a74f99bb1084a4fa2b4
MD5 86864a54030d0193f41b5dec58f8464d
SHA1 c075e1618e8898227e91bb99cfac3e2a71cd95e4
SHA512 6844de2da7a2e8eca055984481b5f60fa447cbdee1413c7c7cb30509adc21ce108be6236676e07ce29fc87a421bca36ceb261080167c54f618312876eb8d3760
SSDEEP 768:z/UxvxjgC+U3a9KnJFxDc9bsMSJz/FnnuSHXPyK/:GZj3+U3ZDVQbs7JT0Sb/
TLSH
T19103C03AEC5058A7CDF767803A8AB657BFF44953C9C529A849DD6E0C07CB3AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2e3684568ca6e45a964632b14a7dcaca64f5c4acd076c8f348fc27e7f9409bb6
MD5 2a7b550eed046431abd0a0a7482ae178
SHA1 884b373da8852c33eeca958a1bd9f76051df7e9e
SHA512 2a0cc5f09c216c07cf01b5bdf295fea10247b457a2e24a3e06570a7188c44dab6bdb1b835248d1c27215ac7afec2d10d688135064ba7de28dfabbbdd043b48f4
SSDEEP 768:ax3RFRKnJOtQxDc9bsMSJz/Fn/74YGHB0:ax3R+JVQbs7JTJ4YUB0
TLSH
T173F2B0B19C605DB38CEAA780B9867A877FF45593C9C91E88D5CDAB0D05C739D230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e47ba776503801f25cfe79c2fb2ddc016902bcb33ffd827bd68518b7710f4737
MD5 be6f2c99de8fe357a567b7d7edb50421
SHA1 2c9af31014cf7dfe4994ef224384b80496e1e514
SHA512 fe351a8321f7daeba3f0a096a966134acdbafa95547027f45f55bcae3e6a45f1f881967b238daa5eec36fecc8328dd7bd1f58bd1cf8c72c4d2ad095ab2a003e3
SSDEEP 768:Ux3KFRKnJOtQxDc9bsMSJz/Fn/74YGHB0:Ux3K+JVQbs7JTJ4YUB0
TLSH
T166F2B0B19C605DB3CCEAA780B9867A877FF45593C9C91E88D5CDAB0D058739D230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cdac3ef22c66c5b2c9fe0b40da1e9d7409220fe3885778cc9fb74b85bbc07cf7
MD5 5882393d8dd2a9fb0565e2850f2f93fa
SHA1 754398c99a491bfcba5448f364c2718314eeecdc
SHA512 ac6e6eddd00673293263500d6438e671617d5647145db3efbfbe24b6484763896b5eb01d6d19298f5d111bf094aeadd0d83a6800fdd7d487a2d088ceb8654b73
SSDEEP 768:+/UxvxjgC+U3QnJKnJOtlxDc9bsMSJz/Fn/7y34s7:zZj3+U3QgOVQbs7JTJXs7
TLSH
T18303CF75AC605D63CCE7A680758B7B97BFF41463C8C61D988ADAAE0C06C73AD1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a23db42f7cb54295309e1900d97e3455b6e28a7f8f51ed03478f25c38079387c
MD5 d5b5ac1e9e88e7f774eace2829e39f97
SHA1 38049aabf7955baa357c5477843a9e7aa66dba38
SHA512 bac38f4e45b21422628770d484ae1b01f2fa8b3a6b811a5b78f86d77862c3f6736e56b9d24ca75daa2d7e31d6cde6d81fd65d4718121390cc526c65b7239fc10
SSDEEP 768:a/UxvxjgC+U3RRlKnJOtuxDc9bsMSJz/Fn/7y34s7:fZj3+U3RuZVQbs7JTJXs7
TLSH
T14A03BF75AC605D63CCE7A680758B7BD7AFF41863C8C51D989ADAAE0C06C73AD1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

b7315e81-7282-4097-a858-d6667fbb7b69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7315e81-7282-4097-a858-d6667fbb7b69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_5475db7bc6a9bc49a7293d52c0f21a7e_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn_vidar.exe
Size 531KB
SHA256 3cd8724cc0aa5df73df6f2800e1516a8e7e4f2d7ab9873ac7ac2a69b780c00b4
MD5 5e3fe288451749ab119b13993429d919
SHA1 a91c9c7fdfa6a2cd4ccd7b29e16075063086de02
SHA512 83d846b3820757664ae352f86e2410b4afbb88942679f8635f7dd441a20494ce3bb756e98d2825c41e79d2eb3cce4f9516517d79c4a2786e2cd0271bb43d200c
SSDEEP 6144:CA39ZqnRplUO83NxqIHDlSIesqScL734ZpVJDKkusdh+idzHjCoMDiMy84uz4qjx:x39bhnc2rfrEshMW5az4qko
TLSH
T1FEC47D26ABE501FAD4B7E178C9974917FA7238594321EADF13D089661F723E0663F302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_1095680305\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 3d0d01360639f26cc1791ad0c363587f902425e8e49362a86fd7db896e3ed624
MD5 9b66aa3e3fddf871f8ceedeff8a0c95e
SHA1 adcad0a51ac8ea5bdcb75c7551631d8ba341d63a
SHA512 647518ce078f4dd4c38c014435428a47c367b835c32f9b5e67d4d24dad740a91f4a60319e072395fdd6a931ee640a553b872c46fbae19f356d7a47bd9133a405
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXB:UVqoCl/YgjxEufVU0TbTyDDalRB
TLSH
T19ED309377E50502EE81285F028BADA79BA523F390BE4AD47335AF705297528339F521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 37a4570c402fdf3aabaa1ba863bfab6a508b4f964b30679a0e61cb3b6f019915
MD5 9fa75aa907548ed7dcb95997fbf51ade
SHA1 2c449a9812c35d986bdb7a591380ac10aff0f6ef
SHA512 1f4d34c17a680bfd6f2b7ecac03acf8059653d22272df3f98383e1520915c05fecf0eb6bbe4f88e4b2f8730a4fdaa3f3a4c7f9651d1e3fb5b733544728d32850
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXn333333333333Q:UVqoCl/YgjxEufVU0TbTyDDalRQ
TLSH
T126D317336E50442FED92CAF168B5D63DBA544F3A0BE06D177666BB003572283B2F521B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 a7de53d4a3ace45b48284cc609efc9d947bb129cf416982910f6d3e93285d6fe
MD5 e4c19b9fec3d6c16069af234a086f44b
SHA1 8412813eca427df0ae5c24c3911f2b6459d63c95
SHA512 d82936aaddfed050751253003d32844f2f0a7e8d51fd9765564b6234da162f245ce34dbd4a43484d314102e9e49205fd43f3506a138c3807d320d510fb107c5a
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXz:UVqoCl/YgjxEufVU0TbTyDDalRz
TLSH
T1AED30813BF5444ABC86189F16CA9E76EB5416E3A1FE56C0B36A5FF01267624372F020F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 7662c11a955ee562206bf68cd2e36cbacdfd0e776cc29dd938a3ca3183a7d94a
MD5 33eebefb2535885b13c1132eb7f1d7b8
SHA1 631dd972299069b9aa3767e146fd7b4db89e6c68
SHA512 16c95be103747007ea9f53428cb678c469be57e04cf31b7163bd9046a8e09bfe309db675c19634cd6ce27373c2cff9c9bb352e8e0baad3a8c6979c497138eda5
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXD:UVqoCl/YgjxEufVU0TbTyDDalRD
TLSH
T165D31A17BE60582ED85288F138A5EB2E7A665F324BD0AC4732A7BF00293564375F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2676-607-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3356-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3356-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4296-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4644-606-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4728-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4756-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download