06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
Size 4.4MB
Sample260729-2lmtastgkd
SHA256 06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2
MD5 6092c380332af86dd4a8c0b2a2e07ac5
SHA1 b54c92eb6aada547806e5ddd1a6efffb97603c42
SHA512 cb4884bd4bcc083c4020c48095dd2b38199f3184b1cc3cf2b18f8922be738654d2f0b2fa4c6d3c0ecd5447e1d76de5becb3d9c248c3f769ce6bb32839f5682e5
SSDEEP 98304:AuWhEDPyTyUJ6vORttlsSP92ftyk98fN4wgOpPOWPAXqQ8oILPsT2Czs:nDQpPvZQ8rbsT2U
TLSH
T117268D47E3A480E9D4ABC179C60B9237E7B2F8491635BB9B13D45F662F23B606B1D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024598-386.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
16	4736	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2128	powershell.exe
516	powershell.exe
1544	powershell.exe
4724	powershell.exe
4736	powershell.exe
3764	powershell.exe
2352	powershell.exe
1772	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
816	chrome.exe
516	msedge.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
16	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4180	chrome.exe
516	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3696	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298385006322794"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{D05FCE0C-4297-4AB4-AC8A-80A77E568853}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	powershell.exe
1544	powershell.exe
4724	powershell.exe
4724	powershell.exe
2128	powershell.exe
2128	powershell.exe
4736	powershell.exe
4736	powershell.exe
3764	powershell.exe
3764	powershell.exe
516	powershell.exe
516	powershell.exe
2352	powershell.exe
2352	powershell.exe
1772	powershell.exe
1772	powershell.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe
Token: 35	3764	powershell.exe
Token: 36	3764	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeIncreaseQuotaPrivilege	2352	powershell.exe
Token: SeSecurityPrivilege	2352	powershell.exe
Token: SeTakeOwnershipPrivilege	2352	powershell.exe
Token: SeLoadDriverPrivilege	2352	powershell.exe
Token: SeSystemProfilePrivilege	2352	powershell.exe
Token: SeSystemtimePrivilege	2352	powershell.exe
Token: SeProfSingleProcessPrivilege	2352	powershell.exe
Token: SeIncBasePriorityPrivilege	2352	powershell.exe
Token: SeCreatePagefilePrivilege	2352	powershell.exe
Token: SeBackupPrivilege	2352	powershell.exe
Token: SeRestorePrivilege	2352	powershell.exe
Token: SeShutdownPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeSystemEnvironmentPrivilege	2352	powershell.exe
Token: SeRemoteShutdownPrivilege	2352	powershell.exe
Token: SeUndockPrivilege	2352	powershell.exe
Token: SeManageVolumePrivilege	2352	powershell.exe
Token: 33	2352	powershell.exe
Token: 34	2352	powershell.exe
Token: 35	2352	powershell.exe
Token: 36	2352	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeIncreaseQuotaPrivilege	1772	powershell.exe
Token: SeSecurityPrivilege	1772	powershell.exe
Token: SeTakeOwnershipPrivilege	1772	powershell.exe
Token: SeLoadDriverPrivilege	1772	powershell.exe
Token: SeSystemProfilePrivilege	1772	powershell.exe
Token: SeSystemtimePrivilege	1772	powershell.exe
Token: SeProfSingleProcessPrivilege	1772	powershell.exe
Token: SeIncBasePriorityPrivilege	1772	powershell.exe
Token: SeCreatePagefilePrivilege	1772	powershell.exe
Token: SeBackupPrivilege	1772	powershell.exe
Token: SeRestorePrivilege	1772	powershell.exe
Token: SeShutdownPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeSystemEnvironmentPrivilege	1772	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
816	chrome.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1544	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	85
PID 2196 wrote to memory of 4724	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	88
PID 2196 wrote to memory of 2128	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2196 wrote to memory of 4736	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2196 wrote to memory of 3696	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2196 wrote to memory of 3204	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	96
PID 2196 wrote to memory of 3764	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	98
PID 2196 wrote to memory of 516	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2196 wrote to memory of 2352	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	102
PID 2196 wrote to memory of 1772	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	104
PID 2196 wrote to memory of 816	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	107
PID 816 wrote to memory of 2408	816	chrome.exe	108
PID 816 wrote to memory of 2116	816	chrome.exe	109
PID 816 wrote to memory of 2116	816	chrome.exe	109
PID 816 wrote to memory of 4180	816	chrome.exe	110
PID 816 wrote to memory of 4556	816	chrome.exe	111
PID 816 wrote to memory of 4556	816	chrome.exe	111
PID 816 wrote to memory of 4484	816	chrome.exe	112
PID 816 wrote to memory of 3912	816	chrome.exe	113
PID 816 wrote to memory of 4484	816	chrome.exe	112
PID 816 wrote to memory of 3912	816	chrome.exe	113
PID 816 wrote to memory of 3536	816	chrome.exe	114
PID 816 wrote to memory of 3536	816	chrome.exe	114
PID 816 wrote to memory of 2636	816	chrome.exe	115
PID 816 wrote to memory of 2636	816	chrome.exe	115
PID 816 wrote to memory of 2752	816	chrome.exe	116
PID 816 wrote to memory of 2752	816	chrome.exe	116
PID 816 wrote to memory of 436	816	chrome.exe	117
PID 816 wrote to memory of 436	816	chrome.exe	117
PID 816 wrote to memory of 3204	816	chrome.exe	118
PID 816 wrote to memory of 3204	816	chrome.exe	118
PID 816 wrote to memory of 1792	816	chrome.exe	119
PID 816 wrote to memory of 1792	816	chrome.exe	119
PID 816 wrote to memory of 4196	816	chrome.exe	123
PID 816 wrote to memory of 1744	816	chrome.exe	124
PID 816 wrote to memory of 3048	816	chrome.exe	125
PID 816 wrote to memory of 1744	816	chrome.exe	124
PID 816 wrote to memory of 3048	816	chrome.exe	125
PID 816 wrote to memory of 2472	816	chrome.exe	127
PID 816 wrote to memory of 2472	816	chrome.exe	127
PID 816 wrote to memory of 3928	816	chrome.exe	128
PID 816 wrote to memory of 3928	816	chrome.exe	128
PID 816 wrote to memory of 3608	816	chrome.exe	129
PID 816 wrote to memory of 3608	816	chrome.exe	129
PID 816 wrote to memory of 1620	816	chrome.exe	130
PID 816 wrote to memory of 1620	816	chrome.exe	130
PID 816 wrote to memory of 648	816	chrome.exe	131
PID 816 wrote to memory of 648	816	chrome.exe	131
PID 816 wrote to memory of 3440	816	chrome.exe	132
PID 816 wrote to memory of 3440	816	chrome.exe	132
PID 2196 wrote to memory of 1720	2196	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	138
PID 1720 wrote to memory of 2712	1720	msedge.exe	139
PID 1720 wrote to memory of 516	1720	msedge.exe	140
PID 1720 wrote to memory of 1056	1720	msedge.exe	141
PID 1720 wrote to memory of 1056	1720	msedge.exe	141
PID 1720 wrote to memory of 1056	1720	msedge.exe	141
PID 1720 wrote to memory of 4484	1720	msedge.exe	142
PID 1720 wrote to memory of 4484	1720	msedge.exe	142
PID 1720 wrote to memory of 4172	1720	msedge.exe	143
PID 1720 wrote to memory of 2208	1720	msedge.exe	144
PID 1720 wrote to memory of 4172	1720	msedge.exe	143
PID 1720 wrote to memory of 4172	1720	msedge.exe	143
PID 1720 wrote to memory of 2208	1720	msedge.exe	144
PID 1720 wrote to memory of 2208	1720	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-WmiObject Win32_Processor).ProcessorId"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-WmiObject Win32_BaseBoard).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-WmiObject Win32_PhysicalMedia | Where-Object {$_.SerialNumber -ne $null} | Select-Object -First 1).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -TimeoutSec 5 -UseBasicParsing).Content.Trim()"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\System32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:3696
- C:\Windows\System32\netsh.exe
  "netsh" wlan export profile key=clear folder=C:\Users\Admin\AppData\Local\Temp\fx_wifi_1785364831265831600
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance -Namespace 'root/SecurityCenter2' -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).PartOfDomain"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Domain"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-popup-notification --no-prefs --disable-background-networking
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffc62eac728,0x7ffc62eac734,0x7ffc62eac740
    3⤵
    PID:2408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:2
    3⤵
    PID:2636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:2
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:4196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
    3⤵
    PID:5316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:5552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome816240766984" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,7001046977250383025,5940248393995945199,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
    3⤵
    PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-popup-notification --no-prefs --disable-background-networking
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1720240777359 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1720240777359\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffc5e1bc188,0x7ffc5e1bc194,0x7ffc5e1bc1a0
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Loads dropped DLL
    - System Time Discovery
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:2
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:2
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:2
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:2
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:2
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:2
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:2
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:2
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2124,i,11645364149872599926,17738298471820992930,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...