xworm | 08b247d6f17fea53b33ce3a38f88fa898e10c96e0f2619ef998e3752d01947a7

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk	audiodg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk	audiodg.exe

Executes dropped EXE 9 IoCs

pid	Process
5068	audiodg.exe
3944	shost.exe
4536	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
1580	audiodg.exe
1132	identity_helper.exe
2416	audiodg.exe
5132	shost.exe
5136	identity_helper..exe
5856	audiodg.exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	identity_helper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon"	audiodg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\E:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\E:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\A:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\R:	shost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX900D.tmp	shost.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC47F.tmp	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXD2EB.tmp	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX8A3C.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXC9AD.tmp	shost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8EAC.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8ECD.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX92AF.tmp	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	shost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX872F.tmp	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX923A.tmp	shost.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX9BE5.tmp	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX9A28.tmp	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXBB6C.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	shost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	shost.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	shost.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	shost.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8A4D.tmp	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\RCX867E.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCXD901.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXE570.tmp	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\RCX99E6.tmp	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX9BA5.tmp	shost.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC93B.tmp	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXD546.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	shost.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	shost.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCXD811.tmp	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	shost.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	shost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	shost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	shost.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	shost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	shost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332268724791889"	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{AD9316A9-F70C-4718-AD48-0ADFEFD073F0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6852	msedge.exe
6852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	audiodg.exe
Token: SeDebugPrivilege	1580	audiodg.exe
Token: SeDebugPrivilege	2416	audiodg.exe
Token: SeDebugPrivilege	5856	audiodg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 5068	3220	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	85
PID 3220 wrote to memory of 3944	3220	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	86
PID 3220 wrote to memory of 4536	3220	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	87
PID 3944 wrote to memory of 1580	3944	shost.exe	88
PID 4536 wrote to memory of 4564	4536	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	101
PID 4564 wrote to memory of 1740	4564	msedge.exe	102
PID 4564 wrote to memory of 2564	4564	msedge.exe	103
PID 4564 wrote to memory of 2664	4564	msedge.exe	104
PID 4564 wrote to memory of 2664	4564	msedge.exe	104
PID 4564 wrote to memory of 2664	4564	msedge.exe	104
PID 4564 wrote to memory of 4888	4564	msedge.exe	106
PID 4564 wrote to memory of 4888	4564	msedge.exe	106
PID 4564 wrote to memory of 636	4564	msedge.exe	107
PID 4564 wrote to memory of 4624	4564	msedge.exe	108
PID 4564 wrote to memory of 636	4564	msedge.exe	107
PID 4564 wrote to memory of 636	4564	msedge.exe	107
PID 4564 wrote to memory of 4624	4564	msedge.exe	108
PID 4564 wrote to memory of 4624	4564	msedge.exe	108
PID 4564 wrote to memory of 4588	4564	msedge.exe	109
PID 4564 wrote to memory of 2352	4564	msedge.exe	110
PID 4564 wrote to memory of 4588	4564	msedge.exe	109
PID 4564 wrote to memory of 4588	4564	msedge.exe	109
PID 4564 wrote to memory of 2352	4564	msedge.exe	110
PID 4564 wrote to memory of 2352	4564	msedge.exe	110
PID 4564 wrote to memory of 1568	4564	msedge.exe	112
PID 4564 wrote to memory of 1568	4564	msedge.exe	112
PID 4564 wrote to memory of 4776	4564	msedge.exe	113
PID 4564 wrote to memory of 4776	4564	msedge.exe	113
PID 4564 wrote to memory of 4700	4564	msedge.exe	115
PID 4564 wrote to memory of 4700	4564	msedge.exe	115
PID 4564 wrote to memory of 4700	4564	msedge.exe	115
PID 4564 wrote to memory of 368	4564	msedge.exe	116
PID 4564 wrote to memory of 368	4564	msedge.exe	116
PID 4564 wrote to memory of 3952	4564	msedge.exe	117
PID 4564 wrote to memory of 3952	4564	msedge.exe	117
PID 4564 wrote to memory of 1132	4564	msedge.exe	119
PID 1132 wrote to memory of 2416	1132	identity_helper.exe	120
PID 1132 wrote to memory of 5132	1132	identity_helper.exe	121
PID 1132 wrote to memory of 5136	1132	identity_helper.exe	122
PID 5132 wrote to memory of 5856	5132	shost.exe	123
PID 4564 wrote to memory of 5680	4564	msedge.exe	125
PID 4564 wrote to memory of 5680	4564	msedge.exe	125
PID 4564 wrote to memory of 5172	4564	msedge.exe	126
PID 4564 wrote to memory of 5172	4564	msedge.exe	126
PID 4564 wrote to memory of 5760	4564	msedge.exe	127
PID 4564 wrote to memory of 5760	4564	msedge.exe	127
PID 4564 wrote to memory of 6552	4564	msedge.exe	128
PID 4564 wrote to memory of 6552	4564	msedge.exe	128
PID 4536 wrote to memory of 6620	4536	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	129
PID 4564 wrote to memory of 6704	4564	msedge.exe	130
PID 4564 wrote to memory of 6704	4564	msedge.exe	130
PID 4564 wrote to memory of 6704	4564	msedge.exe	130
PID 4564 wrote to memory of 7032	4564	msedge.exe	131
PID 4564 wrote to memory of 7032	4564	msedge.exe	131
PID 4564 wrote to memory of 7156	4564	msedge.exe	132
PID 4564 wrote to memory of 7156	4564	msedge.exe	132
PID 4564 wrote to memory of 7156	4564	msedge.exe	132
PID 4564 wrote to memory of 5584	4564	msedge.exe	135
PID 4564 wrote to memory of 5156	4564	msedge.exe	136
PID 4564 wrote to memory of 5220	4564	msedge.exe	137
PID 4564 wrote to memory of 6844	4564	msedge.exe	141
PID 4564 wrote to memory of 6844	4564	msedge.exe	141
PID 4564 wrote to memory of 6160	4564	msedge.exe	142
PID 4564 wrote to memory of 6160	4564	msedge.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Users\Admin\Documents\diagnostics\shost.exe
  "C:\Users\Admin\Documents\diagnostics\shost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x334,0x7ffb1562c188,0x7ffb1562c194,0x7ffb1562c1a0
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,9068488406833892597,5328264380307799628,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      System Time Discovery
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3651649190626967549,6223352249372084509,262144 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,802090060754424349,8423462617595489309,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16380008264022283151,8201893301618760576,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8761588134836136940,18285265296293806292,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1136018812468340395,5158749290044993908,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,389340680906261714,7624811361754900779,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,15032411444985881128,1497829877326389259,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14129175701465741802,16266244120064344160,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5420,i,9483207657881857336,12934338516893563882,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,1625796496219090008,9572983342321564499,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,5666054908205641512,1293809918495655557,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,12000031054510660207,5652502408780314314,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      Executes dropped EXE
      Modifies system executable filetype association
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Users\Admin\Documents\diagnostics\audiodg.exe
        
        "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
    - - C:\Users\Admin\Documents\diagnostics\shost.exe
        
        "C:\Users\Admin\Documents\diagnostics\shost.exe"
        5⤵
        Executes dropped EXE
        Modifies system executable filetype association
        Enumerates connected drives
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5132
      - C:\Users\Admin\Documents\diagnostics\audiodg.exe
        
        "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper..exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper..exe"
        5⤵
        Executes dropped EXE
        
        PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,15427385786093808825,2862584948888483103,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,16280238658473563713,2000312403843421208,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5047457840623453464,8688939626481417373,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12768933460500550799,4270664314500475066,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6468,i,8481614608687808435,8652356978519376754,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,6541164453902966293,8758221033702322989,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
      4⤵
      PID:7032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6108,i,17079923570437289311,9436453887947797764,2097152 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:7156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15139278759677745289,6736774823493952531,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,16390991772430726737,16508615080381458998,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,6320673845490800031,310035176153187923,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,9693952953024749773,12928557569201092604,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,15089643860106148826,9057982340978844565,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,13564872324524910820,14688094892193416836,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,11270304282550029743,13257359153340222914,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
      4⤵
      PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,11385542788493755943,9278336945511651125,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,9968854790640943365,8793066047426327136,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
      4⤵
      PID:7060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,13506335873576675399,17632950423688406202,524288 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,3581917684033530877,4124027037187453591,262144 --field-trial-handle=1984,i,12426879447920851647,6671795912745413464,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:6620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery