asyncrat | 8266069f6262404194219a6c8cf6cf323f4792c81e22cdc91f2e268600b9882c

pid	Process
5544	chrome.exe
4000	chrome.exe
2760	chrome.exe
4472	chrome.exe
1880	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe

Clipboard Data 1 TTPs 6 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4032	cmd.exe
3612	powershell.exe
2224	cmd.exe
2408	powershell.exe
1492	cmd.exe
4896	powershell.exe

Executes dropped EXE 16 IoCs

pid	Process
2852	svhost.exe
1068	svhost.exe
3964	CitiTest.exe
3484	Client.exe
2036	chromelevator_x64.exe
5104	chromelevator_x64.exe
1680	Defender.exe
3144	Defender.exe
656	Defender.exe
2284	Defender.exe
3208	svhost.exe
552	chromelevator_x64.exe
3064	chromelevator_x64.exe
4792	chromelevator_x64.exe
4320	chromelevator_x64.exe
5448	svhost.exe

Loads dropped DLL 64 IoCs

pid	Process
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1068	svhost.exe
1068	svhost.exe
1068	svhost.exe
1068	svhost.exe
1068	svhost.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
2284	Defender.exe
2284	Defender.exe
2284	Defender.exe
2284	Defender.exe
2284	Defender.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defender = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\SystemApps\\Defender.exe"	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defender = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\SystemApps\\Defender.exe"	Defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defender = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\SystemApps\\Defender.exe"	Defender.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
85	discord.com
86	discord.com
17	discord.com

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1488	cmd.exe
1688	cmd.exe
1932	cmd.exe
1564	cmd.exe
3792	cmd.exe
1232	cmd.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

persistence privilege_escalation

Internet Connection Discovery

T1016.001

flow	ioc
10	api.ipify.org
11	api.ipify.org
12	api.ipify.org
13	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00070000000245b5-156.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4424	cmd.exe
4152	cmd.exe
2080	cmd.exe
4636	cmd.exe
2868	cmd.exe
368	cmd.exe
5584	cmd.exe
220	cmd.exe
5976	cmd.exe
4784	cmd.exe
4824	cmd.exe
4920	cmd.exe
2804	cmd.exe
4072	cmd.exe
5824	cmd.exe
2696	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
4072	cmd.exe
4840	netsh.exe
4784	cmd.exe
3204	netsh.exe
5584	cmd.exe
5344	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
3864	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
888	timeout.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
2976	WMIC.exe
5420	WMIC.exe
5272	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4896	schtasks.exe
5116	schtasks.exe
3516	schtasks.exe
3772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
3484	Client.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4896	powershell.exe
4896	powershell.exe
4896	powershell.exe
656	Defender.exe
656	Defender.exe
2284	Defender.exe
2284	Defender.exe
3612	powershell.exe
3612	powershell.exe
3208	svhost.exe
3208	svhost.exe
3208	svhost.exe
3612	powershell.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
656	Defender.exe
2408	powershell.exe
2408	powershell.exe
2408	powershell.exe
4000	chrome.exe
4000	chrome.exe
3208	svhost.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3208	svhost.exe
3208	svhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4000	chrome.exe
4000	chrome.exe
4000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3484	Client.exe
Token: SeIncreaseQuotaPrivilege	5420	WMIC.exe
Token: SeSecurityPrivilege	5420	WMIC.exe
Token: SeTakeOwnershipPrivilege	5420	WMIC.exe
Token: SeLoadDriverPrivilege	5420	WMIC.exe
Token: SeSystemProfilePrivilege	5420	WMIC.exe
Token: SeSystemtimePrivilege	5420	WMIC.exe
Token: SeProfSingleProcessPrivilege	5420	WMIC.exe
Token: SeIncBasePriorityPrivilege	5420	WMIC.exe
Token: SeCreatePagefilePrivilege	5420	WMIC.exe
Token: SeBackupPrivilege	5420	WMIC.exe
Token: SeRestorePrivilege	5420	WMIC.exe
Token: SeShutdownPrivilege	5420	WMIC.exe
Token: SeDebugPrivilege	5420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5420	WMIC.exe
Token: SeRemoteShutdownPrivilege	5420	WMIC.exe
Token: SeUndockPrivilege	5420	WMIC.exe
Token: SeManageVolumePrivilege	5420	WMIC.exe
Token: 33	5420	WMIC.exe
Token: 34	5420	WMIC.exe
Token: 35	5420	WMIC.exe
Token: 36	5420	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5420	WMIC.exe
Token: SeSecurityPrivilege	5420	WMIC.exe
Token: SeTakeOwnershipPrivilege	5420	WMIC.exe
Token: SeLoadDriverPrivilege	5420	WMIC.exe
Token: SeSystemProfilePrivilege	5420	WMIC.exe
Token: SeSystemtimePrivilege	5420	WMIC.exe
Token: SeProfSingleProcessPrivilege	5420	WMIC.exe
Token: SeIncBasePriorityPrivilege	5420	WMIC.exe
Token: SeCreatePagefilePrivilege	5420	WMIC.exe
Token: SeBackupPrivilege	5420	WMIC.exe
Token: SeRestorePrivilege	5420	WMIC.exe
Token: SeShutdownPrivilege	5420	WMIC.exe
Token: SeDebugPrivilege	5420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5420	WMIC.exe
Token: SeRemoteShutdownPrivilege	5420	WMIC.exe
Token: SeUndockPrivilege	5420	WMIC.exe
Token: SeManageVolumePrivilege	5420	WMIC.exe
Token: 33	5420	WMIC.exe
Token: 34	5420	WMIC.exe
Token: 35	5420	WMIC.exe
Token: 36	5420	WMIC.exe
Token: SeDebugPrivilege	3484	Client.exe
Token: SeIncreaseQuotaPrivilege	2624	WMIC.exe
Token: SeSecurityPrivilege	2624	WMIC.exe
Token: SeTakeOwnershipPrivilege	2624	WMIC.exe
Token: SeLoadDriverPrivilege	2624	WMIC.exe
Token: SeSystemProfilePrivilege	2624	WMIC.exe
Token: SeSystemtimePrivilege	2624	WMIC.exe
Token: SeProfSingleProcessPrivilege	2624	WMIC.exe
Token: SeIncBasePriorityPrivilege	2624	WMIC.exe
Token: SeCreatePagefilePrivilege	2624	WMIC.exe
Token: SeBackupPrivilege	2624	WMIC.exe
Token: SeRestorePrivilege	2624	WMIC.exe
Token: SeShutdownPrivilege	2624	WMIC.exe
Token: SeDebugPrivilege	2624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2624	WMIC.exe
Token: SeRemoteShutdownPrivilege	2624	WMIC.exe
Token: SeUndockPrivilege	2624	WMIC.exe
Token: SeManageVolumePrivilege	2624	WMIC.exe
Token: 33	2624	WMIC.exe
Token: 34	2624	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4000	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3208	svhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 6040	4676	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	84
PID 6040 wrote to memory of 2852	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 6040 wrote to memory of 1564	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 2852 wrote to memory of 1068	2852	svhost.exe	91
PID 1564 wrote to memory of 1216	1564	cmd.exe	93
PID 1068 wrote to memory of 3964	1068	svhost.exe	94
PID 1068 wrote to memory of 3484	1068	svhost.exe	95
PID 6040 wrote to memory of 3792	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 3792 wrote to memory of 3392	3792	cmd.exe	99
PID 6040 wrote to memory of 2804	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 2804 wrote to memory of 4896	2804	cmd.exe	102
PID 6040 wrote to memory of 5584	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 6040 wrote to memory of 2036	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 5584 wrote to memory of 5344	5584	cmd.exe	107
PID 6040 wrote to memory of 5104	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 2036 wrote to memory of 872	2036	chromelevator_x64.exe	189
PID 2036 wrote to memory of 872	2036	chromelevator_x64.exe	189
PID 6040 wrote to memory of 220	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 5104 wrote to memory of 5008	5104	chromelevator_x64.exe	116
PID 5104 wrote to memory of 5008	5104	chromelevator_x64.exe	116
PID 220 wrote to memory of 5420	220	cmd.exe	119
PID 1680 wrote to memory of 656	1680	Defender.exe	121
PID 3144 wrote to memory of 2284	3144	Defender.exe	122
PID 2036 wrote to memory of 1712	2036	chromelevator_x64.exe	123
PID 6040 wrote to memory of 4424	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 2036 wrote to memory of 1712	2036	chromelevator_x64.exe	123
PID 5104 wrote to memory of 4340	5104	chromelevator_x64.exe	126
PID 5104 wrote to memory of 4340	5104	chromelevator_x64.exe	126
PID 656 wrote to memory of 4152	656	Defender.exe	128
PID 3484 wrote to memory of 2080	3484	Client.exe	130
PID 3484 wrote to memory of 2868	3484	Client.exe	131
PID 4424 wrote to memory of 2624	4424	cmd.exe	135
PID 2868 wrote to memory of 888	2868	cmd.exe	138
PID 2080 wrote to memory of 5116	2080	cmd.exe	139
PID 2284 wrote to memory of 368	2284	Defender.exe	140
PID 656 wrote to memory of 1232	656	Defender.exe	142
PID 6040 wrote to memory of 1492	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 1232 wrote to memory of 1732	1232	cmd.exe	146
PID 1492 wrote to memory of 4896	1492	cmd.exe	147
PID 656 wrote to memory of 1488	656	Defender.exe	148
PID 2284 wrote to memory of 1688	2284	Defender.exe	150
PID 1488 wrote to memory of 2224	1488	cmd.exe	214
PID 1688 wrote to memory of 3372	1688	cmd.exe	154
PID 656 wrote to memory of 4636	656	Defender.exe	155
PID 2284 wrote to memory of 1932	2284	Defender.exe	157
PID 4636 wrote to memory of 3516	4636	cmd.exe	160
PID 1932 wrote to memory of 5192	1932	cmd.exe	161
PID 2284 wrote to memory of 5976	2284	Defender.exe	162
PID 656 wrote to memory of 552	656	Defender.exe	164
PID 656 wrote to memory of 4072	656	Defender.exe	166
PID 5976 wrote to memory of 3772	5976	cmd.exe	168
PID 656 wrote to memory of 3064	656	Defender.exe	169
PID 6040 wrote to memory of 5544	6040	2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	171
PID 4072 wrote to memory of 4840	4072	cmd.exe	172
PID 5544 wrote to memory of 3980	5544	chrome.exe	173
PID 2284 wrote to memory of 4792	2284	Defender.exe	174
PID 2284 wrote to memory of 4784	2284	Defender.exe	175
PID 656 wrote to memory of 5824	656	Defender.exe	178
PID 2284 wrote to memory of 4320	2284	Defender.exe	180
PID 552 wrote to memory of 5896	552	chromelevator_x64.exe	181
PID 552 wrote to memory of 5896	552	chromelevator_x64.exe	181
PID 4784 wrote to memory of 3204	4784	cmd.exe	183
PID 5824 wrote to memory of 5272	5824	cmd.exe	184
PID 656 wrote to memory of 2696	656	Defender.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-21_6d8e286cb2519171ae25afda3bdccbd3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Users\Admin\AppData\Local\Temp\svhost.exe
    C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\svhost.exe
      C:\Users\Admin\AppData\Local\Temp\svhost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\CitiTest.exe
        
        C:\Users\Admin\AppData\Local\Temp\CitiTest.exe
        5⤵
        Executes dropped EXE
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Client.exe
        
        C:\Users\Admin\AppData\Local\Temp\Client.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3484
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9F48.tmp.bat""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:888
        
        C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        7⤵
        Executes dropped EXE
        
        PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f
      4⤵
      PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f
      4⤵
      PID:3392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe\"" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe\"" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5344
- - C:\Users\Admin\AppData\Local\Temp\_MEI000012442\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI000012442\chromelevator_x64.exe --kill --output-path C:\Users\Admin\AppData\Local\Temp\ce_6040 all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1712
- - C:\Users\Admin\AppData\Local\Temp\_MEI000012442\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI000012442\chromelevator_x64.exe --kill --output-path C:\Users\Admin\AppData\Local\Temp\ce_6040 all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -command "Get-Clipboard -Raw""
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-Clipboard -Raw"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=50374 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd196cc728,0x7ffd196cc734,0x7ffd196cc740
      4⤵
      PID:3980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1984

C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f
      4⤵
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe\"" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe\"" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3516
- - C:\Users\Admin\AppData\Local\Temp\_MEI000006902\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI000006902\chromelevator_x64.exe --kill --output-path C:\Users\Admin\AppData\Local\Temp\ce_656 all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4840
- - C:\Users\Admin\AppData\Local\Temp\_MEI000006902\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI000006902\chromelevator_x64.exe --kill --output-path C:\Users\Admin\AppData\Local\Temp\ce_656 all
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:2696
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -command "Get-Clipboard -Raw""
    3⤵
    - Clipboard Data
    PID:4032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-Clipboard -Raw"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=50494 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd2e1ec728,0x7ffd2e1ec734,0x7ffd2e1ec740
      4⤵
      PID:5160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1892 /prefetch:2
      4⤵
      PID:2064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      System Time Discovery
      PID:3864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2200 /prefetch:8
      4⤵
      PID:4308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50494 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50494 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50494 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5136 /prefetch:8
      4⤵
      PID:5124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:2480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5392 /prefetch:8
      4⤵
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1896,i,5765215517304215979,2350340693481483053,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5304

C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\HealthCheck" /f
      4⤵
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /f
      4⤵
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe\"" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\Windows\SecurityHealth\SystrayInit" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemApps\Defender.exe\"" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3772
- - C:\Users\Admin\AppData\Local\Temp\_MEI00000c482\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI00000c482\chromelevator_x64.exe --kill --output-path C:\Users\Admin\AppData\Local\Temp\ce_2284 all
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3204
- - C:\Users\Admin\AppData\Local\Temp\_MEI00000c482\chromelevator_x64.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI00000c482\chromelevator_x64.exe --kill --output-path C:\Users\Admin\AppData\Local\Temp\ce_2284 all
    3⤵
    - Executes dropped EXE
    PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:4824
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:872
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:4920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -command "Get-Clipboard -Raw""
    3⤵
    - Clipboard Data
    PID:2224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-Clipboard -Raw"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5744

C:\Users\Admin\AppData\Roaming\svhost.exe
"C:\Users\Admin\AppData\Roaming\svhost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Authentication Process

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery