06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
Size 4.4MB
Sample260729-2lmtastgkd
SHA256 06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2
MD5 6092c380332af86dd4a8c0b2a2e07ac5
SHA1 b54c92eb6aada547806e5ddd1a6efffb97603c42
SHA512 cb4884bd4bcc083c4020c48095dd2b38199f3184b1cc3cf2b18f8922be738654d2f0b2fa4c6d3c0ecd5447e1d76de5becb3d9c248c3f769ce6bb32839f5682e5
SSDEEP 98304:AuWhEDPyTyUJ6vORttlsSP92ftyk98fN4wgOpPOWPAXqQ8oILPsT2Czs:nDQpPvZQ8rbsT2U
TLSH
T117268D47E3A480E9D4ABC179C60B9237E7B2F8491635BB9B13D45F662F23B606B1D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5e2-290.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1076	powershell.exe
4212	powershell.exe
2396	powershell.exe
1136	powershell.exe
5036	powershell.exe
4948	powershell.exe
588	powershell.exe
1792	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	chrome.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	chrome.exe
6060	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5180	ipconfig.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298384969450013"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{9336C9C6-512E-4EB7-98BB-BCDDD0BE9A73}	msedge.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5036	powershell.exe
5036	powershell.exe
4948	powershell.exe
4948	powershell.exe
588	powershell.exe
588	powershell.exe
1076	powershell.exe
1076	powershell.exe
4212	powershell.exe
4212	powershell.exe
1792	powershell.exe
1792	powershell.exe
1136	powershell.exe
1136	powershell.exe
2396	powershell.exe
2396	powershell.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
3936	chrome.exe
3936	chrome.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
3936	chrome.exe
3936	chrome.exe
5180	msedge.exe
5180	msedge.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeIncreaseQuotaPrivilege	4212	powershell.exe
Token: SeSecurityPrivilege	4212	powershell.exe
Token: SeTakeOwnershipPrivilege	4212	powershell.exe
Token: SeLoadDriverPrivilege	4212	powershell.exe
Token: SeSystemProfilePrivilege	4212	powershell.exe
Token: SeSystemtimePrivilege	4212	powershell.exe
Token: SeProfSingleProcessPrivilege	4212	powershell.exe
Token: SeIncBasePriorityPrivilege	4212	powershell.exe
Token: SeCreatePagefilePrivilege	4212	powershell.exe
Token: SeBackupPrivilege	4212	powershell.exe
Token: SeRestorePrivilege	4212	powershell.exe
Token: SeShutdownPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeSystemEnvironmentPrivilege	4212	powershell.exe
Token: SeRemoteShutdownPrivilege	4212	powershell.exe
Token: SeUndockPrivilege	4212	powershell.exe
Token: SeManageVolumePrivilege	4212	powershell.exe
Token: 33	4212	powershell.exe
Token: 34	4212	powershell.exe
Token: 35	4212	powershell.exe
Token: 36	4212	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeIncreaseQuotaPrivilege	1792	powershell.exe
Token: SeSecurityPrivilege	1792	powershell.exe
Token: SeTakeOwnershipPrivilege	1792	powershell.exe
Token: SeLoadDriverPrivilege	1792	powershell.exe
Token: SeSystemProfilePrivilege	1792	powershell.exe
Token: SeSystemtimePrivilege	1792	powershell.exe
Token: SeProfSingleProcessPrivilege	1792	powershell.exe
Token: SeIncBasePriorityPrivilege	1792	powershell.exe
Token: SeCreatePagefilePrivilege	1792	powershell.exe
Token: SeBackupPrivilege	1792	powershell.exe
Token: SeRestorePrivilege	1792	powershell.exe
Token: SeShutdownPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeSystemEnvironmentPrivilege	1792	powershell.exe
Token: SeRemoteShutdownPrivilege	1792	powershell.exe
Token: SeUndockPrivilege	1792	powershell.exe
Token: SeManageVolumePrivilege	1792	powershell.exe
Token: 33	1792	powershell.exe
Token: 34	1792	powershell.exe
Token: 35	1792	powershell.exe
Token: 36	1792	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeIncreaseQuotaPrivilege	1136	powershell.exe
Token: SeSecurityPrivilege	1136	powershell.exe
Token: SeTakeOwnershipPrivilege	1136	powershell.exe
Token: SeLoadDriverPrivilege	1136	powershell.exe
Token: SeSystemProfilePrivilege	1136	powershell.exe
Token: SeSystemtimePrivilege	1136	powershell.exe
Token: SeProfSingleProcessPrivilege	1136	powershell.exe
Token: SeIncBasePriorityPrivilege	1136	powershell.exe
Token: SeCreatePagefilePrivilege	1136	powershell.exe
Token: SeBackupPrivilege	1136	powershell.exe
Token: SeRestorePrivilege	1136	powershell.exe
Token: SeShutdownPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeSystemEnvironmentPrivilege	1136	powershell.exe
Token: SeRemoteShutdownPrivilege	1136	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3936	chrome.exe
5180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 5036	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4348 wrote to memory of 4948	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	92
PID 4348 wrote to memory of 588	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	94
PID 4348 wrote to memory of 1076	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	96
PID 4348 wrote to memory of 5180	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	98
PID 4348 wrote to memory of 3440	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4348 wrote to memory of 4212	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	102
PID 4348 wrote to memory of 1792	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	104
PID 4348 wrote to memory of 1136	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	107
PID 4348 wrote to memory of 2396	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	109
PID 4348 wrote to memory of 3936	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	112
PID 3936 wrote to memory of 2696	3936	chrome.exe	113
PID 3936 wrote to memory of 3420	3936	chrome.exe	114
PID 3936 wrote to memory of 5360	3936	chrome.exe	116
PID 3936 wrote to memory of 5360	3936	chrome.exe	116
PID 3936 wrote to memory of 4576	3936	chrome.exe	115
PID 3936 wrote to memory of 4576	3936	chrome.exe	115
PID 3936 wrote to memory of 428	3936	chrome.exe	117
PID 3936 wrote to memory of 428	3936	chrome.exe	117
PID 3936 wrote to memory of 5500	3936	chrome.exe	118
PID 3936 wrote to memory of 5500	3936	chrome.exe	118
PID 3936 wrote to memory of 5828	3936	chrome.exe	120
PID 3936 wrote to memory of 4608	3936	chrome.exe	119
PID 3936 wrote to memory of 5828	3936	chrome.exe	120
PID 3936 wrote to memory of 4608	3936	chrome.exe	119
PID 3936 wrote to memory of 3516	3936	chrome.exe	121
PID 3936 wrote to memory of 3516	3936	chrome.exe	121
PID 3936 wrote to memory of 5312	3936	chrome.exe	122
PID 3936 wrote to memory of 5312	3936	chrome.exe	122
PID 3936 wrote to memory of 1124	3936	chrome.exe	123
PID 3936 wrote to memory of 1124	3936	chrome.exe	123
PID 3936 wrote to memory of 3660	3936	chrome.exe	124
PID 3936 wrote to memory of 1792	3936	chrome.exe	125
PID 3936 wrote to memory of 1792	3936	chrome.exe	125
PID 3936 wrote to memory of 1488	3936	chrome.exe	126
PID 3936 wrote to memory of 1488	3936	chrome.exe	126
PID 3936 wrote to memory of 2872	3936	chrome.exe	130
PID 3936 wrote to memory of 3964	3936	chrome.exe	129
PID 3936 wrote to memory of 2872	3936	chrome.exe	130
PID 3936 wrote to memory of 3964	3936	chrome.exe	129
PID 3936 wrote to memory of 5504	3936	chrome.exe	131
PID 3936 wrote to memory of 3312	3936	chrome.exe	132
PID 3936 wrote to memory of 5504	3936	chrome.exe	131
PID 3936 wrote to memory of 3312	3936	chrome.exe	132
PID 3936 wrote to memory of 3452	3936	chrome.exe	133
PID 3936 wrote to memory of 4132	3936	chrome.exe	134
PID 3936 wrote to memory of 3452	3936	chrome.exe	133
PID 3936 wrote to memory of 4132	3936	chrome.exe	134
PID 4348 wrote to memory of 5180	4348	2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe	137
PID 5180 wrote to memory of 3000	5180	msedge.exe	138
PID 5180 wrote to memory of 1952	5180	msedge.exe	139
PID 5180 wrote to memory of 6060	5180	msedge.exe	140
PID 5180 wrote to memory of 1952	5180	msedge.exe	139
PID 5180 wrote to memory of 1952	5180	msedge.exe	139
PID 5180 wrote to memory of 1644	5180	msedge.exe	141
PID 5180 wrote to memory of 1644	5180	msedge.exe	141
PID 5180 wrote to memory of 4836	5180	msedge.exe	142
PID 5180 wrote to memory of 4836	5180	msedge.exe	142
PID 5180 wrote to memory of 4836	5180	msedge.exe	142
PID 5180 wrote to memory of 3264	5180	msedge.exe	143
PID 5180 wrote to memory of 3264	5180	msedge.exe	143
PID 5180 wrote to memory of 3264	5180	msedge.exe	143
PID 5180 wrote to memory of 1184	5180	msedge.exe	144
PID 5180 wrote to memory of 3660	5180	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-WmiObject Win32_Processor).ProcessorId"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-WmiObject Win32_BaseBoard).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-WmiObject Win32_PhysicalMedia | Where-Object {$_.SerialNumber -ne $null} | Select-Object -First 1).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -TimeoutSec 5 -UseBasicParsing).Content.Trim()"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\System32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:5180
- C:\Windows\System32\netsh.exe
  "netsh" wlan export profile key=clear folder=C:\Users\Admin\AppData\Local\Temp\fx_wifi_1785364848909829800
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance -Namespace 'root/SecurityCenter2' -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).PartOfDomain"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Domain"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-popup-notification --no-prefs --disable-background-networking
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa3236c728,0x7ffa3236c734,0x7ffa3236c740
    3⤵
    - Loads dropped DLL
    PID:2696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:4576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:13
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:3516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
    3⤵
    PID:5312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:3660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:2872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=260 /prefetch:14
    3⤵
    PID:6272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:6280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3936240785328" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,16778186167472831453,14668812593551573176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
    3⤵
    PID:6288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-popup-notification --no-prefs --disable-background-networking
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5180240795796 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5180240795796\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x230,0x26c,0x7ffa2d88c188,0x7ffa2d88c194,0x7ffa2d88c1a0
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:9
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:9
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:9
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:9
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:9
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:9
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:9
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2244,i,15300295910553016481,13036384220098875539,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:14
    3⤵
    PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact