f402885186cbb1dc9f666d5934f56757902a576782652c58814884bb22e27fc2

pid	Process
2984	chrome.exe
2668	chrome.exe
3376	chrome.exe
4400	chrome.exe
2784	chrome.exe
4132	chrome.exe
2928	chrome.exe
1892	chrome.exe
5912	chrome.exe
780	chrome.exe
2676	chrome.exe
5788	chrome.exe
4280	chrome.exe
5236	chrome.exe
6048	chrome.exe
5052	chrome.exe
1332	chrome.exe
1684	chrome.exe
2040	chrome.exe
4420	chrome.exe

Clipboard Data 1 TTPs 6 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3160	cmd.exe
3704	cmd.exe
3456	powershell.exe
4544	powershell.exe
5716	cmd.exe
4212	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5028	csgohile.exe
5896	vgtray.exe
1876	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe

Loads dropped DLL 64 IoCs

pid	Process
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
4928	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
4928	vgtray.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\vgtray.exe = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\SystemApps\\vgtray.exe"	vgtray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\vgtray.exe = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\SystemApps\\vgtray.exe"	vgtray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\vgtray.exe = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\SystemApps\\vgtray.exe"	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2256	cmd.exe
4492	cmd.exe
4340	cmd.exe
2364	cmd.exe
2868	cmd.exe
2564	cmd.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

persistence privilege_escalation

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org
12	api.ipify.org
13	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe
4824	cmd.exe
5324	cmd.exe
1704	cmd.exe
4512	cmd.exe
4612	cmd.exe
956	cmd.exe
5080	cmd.exe
5548	cmd.exe
5100	cmd.exe
792	cmd.exe
4392	cmd.exe
5624	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vgtray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vgtray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vgtray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vgtray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
4476	netsh.exe
4824	cmd.exe
4928	netsh.exe
956	cmd.exe
5080	cmd.exe
6024	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4788	chrome.exe
5276	chrome.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
2424	WMIC.exe
240	WMIC.exe
2932	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3432	schtasks.exe
3520	schtasks.exe
4892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	WMIC.exe
2932	WMIC.exe
2932	WMIC.exe
2932	WMIC.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1028	WMIC.exe
1028	WMIC.exe
1028	WMIC.exe
6048	chrome.exe
6048	chrome.exe
1028	WMIC.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
5036	vgtray.exe
4928	vgtray.exe
4928	vgtray.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe
4420	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeIncreaseQuotaPrivilege	2932	WMIC.exe
Token: SeSecurityPrivilege	2932	WMIC.exe
Token: SeTakeOwnershipPrivilege	2932	WMIC.exe
Token: SeLoadDriverPrivilege	2932	WMIC.exe
Token: SeSystemProfilePrivilege	2932	WMIC.exe
Token: SeSystemtimePrivilege	2932	WMIC.exe
Token: SeProfSingleProcessPrivilege	2932	WMIC.exe
Token: SeIncBasePriorityPrivilege	2932	WMIC.exe
Token: SeCreatePagefilePrivilege	2932	WMIC.exe
Token: SeBackupPrivilege	2932	WMIC.exe
Token: SeRestorePrivilege	2932	WMIC.exe
Token: SeShutdownPrivilege	2932	WMIC.exe
Token: SeDebugPrivilege	2932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2932	WMIC.exe
Token: SeRemoteShutdownPrivilege	2932	WMIC.exe
Token: SeUndockPrivilege	2932	WMIC.exe
Token: SeManageVolumePrivilege	2932	WMIC.exe
Token: 33	2932	WMIC.exe
Token: 34	2932	WMIC.exe
Token: 35	2932	WMIC.exe
Token: 36	2932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2932	WMIC.exe
Token: SeSecurityPrivilege	2932	WMIC.exe
Token: SeTakeOwnershipPrivilege	2932	WMIC.exe
Token: SeLoadDriverPrivilege	2932	WMIC.exe
Token: SeSystemProfilePrivilege	2932	WMIC.exe
Token: SeSystemtimePrivilege	2932	WMIC.exe
Token: SeProfSingleProcessPrivilege	2932	WMIC.exe
Token: SeIncBasePriorityPrivilege	2932	WMIC.exe
Token: SeCreatePagefilePrivilege	2932	WMIC.exe
Token: SeBackupPrivilege	2932	WMIC.exe
Token: SeRestorePrivilege	2932	WMIC.exe
Token: SeShutdownPrivilege	2932	WMIC.exe
Token: SeDebugPrivilege	2932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2932	WMIC.exe
Token: SeRemoteShutdownPrivilege	2932	WMIC.exe
Token: SeUndockPrivilege	2932	WMIC.exe
Token: SeManageVolumePrivilege	2932	WMIC.exe
Token: 33	2932	WMIC.exe
Token: 34	2932	WMIC.exe
Token: 35	2932	WMIC.exe
Token: 36	2932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1028	WMIC.exe
Token: SeSecurityPrivilege	1028	WMIC.exe
Token: SeTakeOwnershipPrivilege	1028	WMIC.exe
Token: SeLoadDriverPrivilege	1028	WMIC.exe
Token: SeSystemProfilePrivilege	1028	WMIC.exe
Token: SeSystemtimePrivilege	1028	WMIC.exe
Token: SeProfSingleProcessPrivilege	1028	WMIC.exe
Token: SeIncBasePriorityPrivilege	1028	WMIC.exe
Token: SeCreatePagefilePrivilege	1028	WMIC.exe
Token: SeBackupPrivilege	1028	WMIC.exe
Token: SeRestorePrivilege	1028	WMIC.exe
Token: SeShutdownPrivilege	1028	WMIC.exe
Token: SeDebugPrivilege	1028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1028	WMIC.exe
Token: SeRemoteShutdownPrivilege	1028	WMIC.exe
Token: SeUndockPrivilege	1028	WMIC.exe
Token: SeManageVolumePrivilege	1028	WMIC.exe
Token: 33	1028	WMIC.exe
Token: 34	1028	WMIC.exe
Token: 35	1028	WMIC.exe
Token: 36	1028	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6048	chrome.exe
4420	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3392	1800	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 3392 wrote to memory of 5028	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 3392 wrote to memory of 2256	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 2256 wrote to memory of 5240	2256	cmd.exe	94
PID 3392 wrote to memory of 4492	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 4492 wrote to memory of 632	4492	cmd.exe	97
PID 3392 wrote to memory of 1548	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 1548 wrote to memory of 3432	1548	cmd.exe	100
PID 3392 wrote to memory of 4824	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 3392 wrote to memory of 5324	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 4824 wrote to memory of 4928	4824	cmd.exe	129
PID 5324 wrote to memory of 2932	5324	cmd.exe	108
PID 3392 wrote to memory of 6048	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 3392 wrote to memory of 1704	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 6048 wrote to memory of 4964	6048	chrome.exe	110
PID 3392 wrote to memory of 2928	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 1704 wrote to memory of 1028	1704	cmd.exe	116
PID 6048 wrote to memory of 2644	6048	chrome.exe	117
PID 6048 wrote to memory of 2644	6048	chrome.exe	117
PID 6048 wrote to memory of 5276	6048	chrome.exe	118
PID 2928 wrote to memory of 5364	2928	chrome.exe	119
PID 6048 wrote to memory of 2120	6048	chrome.exe	120
PID 6048 wrote to memory of 2120	6048	chrome.exe	120
PID 6048 wrote to memory of 1332	6048	chrome.exe	122
PID 6048 wrote to memory of 1332	6048	chrome.exe	122
PID 6048 wrote to memory of 5052	6048	chrome.exe	123
PID 6048 wrote to memory of 5052	6048	chrome.exe	123
PID 6048 wrote to memory of 2040	6048	chrome.exe	124
PID 6048 wrote to memory of 2040	6048	chrome.exe	124
PID 3392 wrote to memory of 5716	3392	2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 5716 wrote to memory of 4212	5716	cmd.exe	127
PID 1876 wrote to memory of 5036	1876	vgtray.exe	128
PID 5896 wrote to memory of 4928	5896	vgtray.exe	129
PID 5036 wrote to memory of 4512	5036	vgtray.exe	130
PID 4928 wrote to memory of 4340	4928	vgtray.exe	132
PID 5036 wrote to memory of 2364	5036	vgtray.exe	133
PID 4340 wrote to memory of 5796	4340	cmd.exe	136
PID 2364 wrote to memory of 5676	2364	cmd.exe	137
PID 4928 wrote to memory of 2868	4928	vgtray.exe	138
PID 5036 wrote to memory of 2564	5036	vgtray.exe	140
PID 2868 wrote to memory of 5332	2868	cmd.exe	142
PID 2564 wrote to memory of 5236	2564	cmd.exe	198
PID 4928 wrote to memory of 4612	4928	vgtray.exe	144
PID 5036 wrote to memory of 5548	5036	vgtray.exe	145
PID 5548 wrote to memory of 4892	5548	cmd.exe	148
PID 4612 wrote to memory of 3520	4612	cmd.exe	149
PID 5036 wrote to memory of 956	5036	vgtray.exe	150
PID 4928 wrote to memory of 5080	4928	vgtray.exe	152
PID 5036 wrote to memory of 5100	5036	vgtray.exe	154
PID 4928 wrote to memory of 792	4928	vgtray.exe	156
PID 956 wrote to memory of 6024	956	cmd.exe	157
PID 5080 wrote to memory of 4476	5080	cmd.exe	159
PID 5100 wrote to memory of 240	5100	cmd.exe	160
PID 792 wrote to memory of 2424	792	cmd.exe	161
PID 5036 wrote to memory of 4392	5036	vgtray.exe	162
PID 4928 wrote to memory of 5624	4928	vgtray.exe	164
PID 4392 wrote to memory of 1088	4392	cmd.exe	166
PID 5624 wrote to memory of 1836	5624	cmd.exe	167
PID 5036 wrote to memory of 3160	5036	vgtray.exe	168
PID 4928 wrote to memory of 3704	4928	vgtray.exe	170
PID 3160 wrote to memory of 3456	3160	cmd.exe	172
PID 3704 wrote to memory of 4544	3704	cmd.exe	173
PID 5036 wrote to memory of 3376	5036	vgtray.exe	174
PID 5036 wrote to memory of 4420	5036	vgtray.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_62f0856c8f2f405ad5efada96823adae_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\csgohile.exe
    C:\Users\Admin\AppData\Local\Temp\csgohile.exe
    3⤵
    - Executes dropped EXE
    PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f
      4⤵
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f
      4⤵
      PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe\"" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe\"" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=50933 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc50fcc728,0x7ffc50fcc734,0x7ffc50fcc740
      4⤵
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1792,i,14336237454465700809,7658765303236836246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
      4⤵
      PID:2644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,14336237454465700809,7658765303236836246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
      4⤵
      System Time Discovery
      PID:5276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,14336237454465700809,7658765303236836246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:13
      4⤵
      PID:2120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50933 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1792,i,14336237454465700809,7658765303236836246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50933 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1792,i,14336237454465700809,7658765303236836246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50933 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1792,i,14336237454465700809,7658765303236836246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=50936 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc50fcc728,0x7ffc50fcc734,0x7ffc50fcc740
      4⤵
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -command "Get-Clipboard -Raw""
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-Clipboard -Raw"
      4⤵
      Clipboard Data
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4212

C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f
      4⤵
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f
      4⤵
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe\"" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe\"" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -command "Get-Clipboard -Raw""
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-Clipboard -Raw"
      4⤵
      Clipboard Data
      Enumerates connected drives
      PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=53104 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    PID:4400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffc50fcc728,0x7ffc50fcc734,0x7ffc50fcc740
      4⤵
      PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=53107 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    PID:1892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc50fcc728,0x7ffc50fcc734,0x7ffc50fcc740
      4⤵
      PID:5584

C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f
      4⤵
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f
      4⤵
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe\"" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\vgtray.exe\"" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -command "Get-Clipboard -Raw""
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-Clipboard -Raw"
      4⤵
      Clipboard Data
      Enumerates connected drives
      PID:3456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=53102 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    PID:3376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc50fcc728,0x7ffc50fcc734,0x7ffc50fcc740
      4⤵
      PID:3064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=53103 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc50fcc728,0x7ffc50fcc734,0x7ffc50fcc740
      4⤵
      PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:3724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:11
      4⤵
      System Time Discovery
      PID:4788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:13
      4⤵
      PID:5348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=53103 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,2874205226754950871,18260177296517499755,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:5004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Authentication Process

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery