610d61136bc2c09252fb52d5dcdda6f0600d8d33c9ded6eb7a88f1bc0d83ebf6

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-08-15_e917b4606d3f8f4bc359ee8e71b44bbb_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe

Executes dropped EXE 4 IoCs

pid	Process
3824	javaw.exe
720	runtime_helper.exe
1752	runtime_helper.exe
4728	runtime_helper.exe

Loads dropped DLL 12 IoCs

pid	Process
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "wscript.exe //B C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\wus_watcher.vbs"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
14	discord.com
15	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2344	wscript.exe
5948	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2540	cmd.exe
5780	cmd.exe
752	cmd.exe
1344	cmd.exe
2932	cmd.exe
4624	cmd.exe
4916	cmd.exe
5340	cmd.exe
2756	cmd.exe
1844	cmd.exe
3936	cmd.exe
5536	cmd.exe
3672	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
468	wmic.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
4128	taskkill.exe
5184	taskkill.exe
4680	taskkill.exe
4124	taskkill.exe
3852	taskkill.exe
388	taskkill.exe
1528	taskkill.exe
5844	taskkill.exe
3996	taskkill.exe
3412	taskkill.exe
5744	taskkill.exe
1460	taskkill.exe
5128	taskkill.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
1428	reg.exe
2936	reg.exe
3056	reg.exe
4496	reg.exe
1652	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe
3824	javaw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	5744	taskkill.exe
Token: SeDebugPrivilege	1460	taskkill.exe
Token: SeDebugPrivilege	5128	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	388	taskkill.exe
Token: SeIncreaseQuotaPrivilege	468	wmic.exe
Token: SeSecurityPrivilege	468	wmic.exe
Token: SeTakeOwnershipPrivilege	468	wmic.exe
Token: SeLoadDriverPrivilege	468	wmic.exe
Token: SeSystemProfilePrivilege	468	wmic.exe
Token: SeSystemtimePrivilege	468	wmic.exe
Token: SeProfSingleProcessPrivilege	468	wmic.exe
Token: SeIncBasePriorityPrivilege	468	wmic.exe
Token: SeCreatePagefilePrivilege	468	wmic.exe
Token: SeBackupPrivilege	468	wmic.exe
Token: SeRestorePrivilege	468	wmic.exe
Token: SeShutdownPrivilege	468	wmic.exe
Token: SeDebugPrivilege	468	wmic.exe
Token: SeSystemEnvironmentPrivilege	468	wmic.exe
Token: SeRemoteShutdownPrivilege	468	wmic.exe
Token: SeUndockPrivilege	468	wmic.exe
Token: SeManageVolumePrivilege	468	wmic.exe
Token: 33	468	wmic.exe
Token: 34	468	wmic.exe
Token: 35	468	wmic.exe
Token: 36	468	wmic.exe
Token: SeIncreaseQuotaPrivilege	468	wmic.exe
Token: SeSecurityPrivilege	468	wmic.exe
Token: SeTakeOwnershipPrivilege	468	wmic.exe
Token: SeLoadDriverPrivilege	468	wmic.exe
Token: SeSystemProfilePrivilege	468	wmic.exe
Token: SeSystemtimePrivilege	468	wmic.exe
Token: SeProfSingleProcessPrivilege	468	wmic.exe
Token: SeIncBasePriorityPrivilege	468	wmic.exe
Token: SeCreatePagefilePrivilege	468	wmic.exe
Token: SeBackupPrivilege	468	wmic.exe
Token: SeRestorePrivilege	468	wmic.exe
Token: SeShutdownPrivilege	468	wmic.exe
Token: SeDebugPrivilege	468	wmic.exe
Token: SeSystemEnvironmentPrivilege	468	wmic.exe
Token: SeRemoteShutdownPrivilege	468	wmic.exe
Token: SeUndockPrivilege	468	wmic.exe
Token: SeManageVolumePrivilege	468	wmic.exe
Token: 33	468	wmic.exe
Token: 34	468	wmic.exe
Token: 35	468	wmic.exe
Token: 36	468	wmic.exe
Token: SeIncreaseQuotaPrivilege	1480	wmic.exe
Token: SeSecurityPrivilege	1480	wmic.exe
Token: SeTakeOwnershipPrivilege	1480	wmic.exe
Token: SeLoadDriverPrivilege	1480	wmic.exe
Token: SeSystemProfilePrivilege	1480	wmic.exe
Token: SeSystemtimePrivilege	1480	wmic.exe
Token: SeProfSingleProcessPrivilege	1480	wmic.exe
Token: SeIncBasePriorityPrivilege	1480	wmic.exe
Token: SeCreatePagefilePrivilege	1480	wmic.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 3824	5828	2026-08-15_e917b4606d3f8f4bc359ee8e71b44bbb_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	85
PID 3824 wrote to memory of 2344	3824	javaw.exe	87
PID 3824 wrote to memory of 5948	3824	javaw.exe	88
PID 3824 wrote to memory of 1428	3824	javaw.exe	89
PID 3824 wrote to memory of 5576	3824	javaw.exe	91
PID 3824 wrote to memory of 720	3824	javaw.exe	95
PID 720 wrote to memory of 5096	720	runtime_helper.exe	98
PID 720 wrote to memory of 5096	720	runtime_helper.exe	98
PID 3824 wrote to memory of 1752	3824	javaw.exe	101
PID 1752 wrote to memory of 1880	1752	runtime_helper.exe	103
PID 1752 wrote to memory of 1880	1752	runtime_helper.exe	103
PID 3824 wrote to memory of 4728	3824	javaw.exe	106
PID 4728 wrote to memory of 2456	4728	runtime_helper.exe	108
PID 4728 wrote to memory of 2456	4728	runtime_helper.exe	108
PID 4728 wrote to memory of 2992	4728	runtime_helper.exe	111
PID 4728 wrote to memory of 2992	4728	runtime_helper.exe	111
PID 3824 wrote to memory of 5340	3824	javaw.exe	114
PID 5340 wrote to memory of 5184	5340	cmd.exe	116
PID 3824 wrote to memory of 752	3824	javaw.exe	118
PID 752 wrote to memory of 1528	752	cmd.exe	120
PID 3824 wrote to memory of 2756	3824	javaw.exe	121
PID 2756 wrote to memory of 5844	2756	cmd.exe	123
PID 3824 wrote to memory of 1844	3824	javaw.exe	124
PID 1844 wrote to memory of 4680	1844	cmd.exe	126
PID 3824 wrote to memory of 3936	3824	javaw.exe	127
PID 3936 wrote to memory of 3996	3936	cmd.exe	129
PID 3824 wrote to memory of 1344	3824	javaw.exe	130
PID 1344 wrote to memory of 4124	1344	cmd.exe	132
PID 3824 wrote to memory of 5536	3824	javaw.exe	133
PID 5536 wrote to memory of 3412	5536	cmd.exe	135
PID 3824 wrote to memory of 3672	3824	javaw.exe	136
PID 3672 wrote to memory of 5744	3672	cmd.exe	138
PID 3824 wrote to memory of 2540	3824	javaw.exe	139
PID 2540 wrote to memory of 1460	2540	cmd.exe	141
PID 3824 wrote to memory of 5780	3824	javaw.exe	142
PID 5780 wrote to memory of 5128	5780	cmd.exe	144
PID 3824 wrote to memory of 2932	3824	javaw.exe	145
PID 2932 wrote to memory of 4128	2932	cmd.exe	147
PID 3824 wrote to memory of 4624	3824	javaw.exe	148
PID 4624 wrote to memory of 3852	4624	cmd.exe	150
PID 3824 wrote to memory of 4916	3824	javaw.exe	151
PID 4916 wrote to memory of 388	4916	cmd.exe	153
PID 3824 wrote to memory of 468	3824	javaw.exe	154
PID 3824 wrote to memory of 1480	3824	javaw.exe	156
PID 3824 wrote to memory of 2936	3824	javaw.exe	158
PID 3824 wrote to memory of 3056	3824	javaw.exe	160
PID 3824 wrote to memory of 4496	3824	javaw.exe	162
PID 3824 wrote to memory of 1652	3824	javaw.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-15_e917b4606d3f8f4bc359ee8e71b44bbb_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_e917b4606d3f8f4bc359ee8e71b44bbb_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\modules.jar;C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\libs\* e C:\Users\Admin\AppData\Local\Temp\2026-08-15_e917b4606d3f8f4bc359ee8e71b44bbb_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe --force
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B C:\Users\Admin\AppData\Local\Temp\wus_1786770616339.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2344
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5948
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "wscript.exe //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1428
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn WindowsUpdateService /tr "wscript.exe //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs"" /sc onlogon /delay 0001:00 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5576
- - C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\native\runtime_helper.exe chrome -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_15347e2a -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5096
- - C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\native\runtime_helper.exe edge -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_f8ae1f4b -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1880
- - C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Nobody\Quick_Resolution_Changer\cache\d8bdca00db964920e429\native\runtime_helper.exe all -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_9e157360 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im brave.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im msedge.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im yandexbrowser.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im yandexbrowser.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4680
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3996
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im chrome.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5744
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im vivaldi.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1460
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera_gx.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera_gx.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:388
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox /s
    3⤵
    - Modifies registry key
    PID:2936
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxStudio /s
    3⤵
    - Modifies registry key
    PID:3056
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxPlayer /s
    3⤵
    - Modifies registry key
    PID:4496
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Valve\Steam /v SteamPath
    3⤵
    - Modifies registry key
    PID:1652

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery