19dfc0f932152c4d6361a48b5d7aa13ba0271c7a182303e34894ef8525cd285e

pid	Process
5676	chrome.exe
5500	chrome.exe
524	chrome.exe
1444	chrome.exe
3812	chrome.exe
4308	chrome.exe
3944	chrome.exe
4344	chrome.exe
4048	chrome.exe
4644	chrome.exe
3124	chrome.exe
1236	chrome.exe
2148	chrome.exe
2392	chrome.exe
5168	chrome.exe
5892	chrome.exe
1340	chrome.exe
5036	chrome.exe
1736	chrome.exe
2476	chrome.exe
4744	chrome.exe
5668	chrome.exe
5124	chrome.exe
5496	chrome.exe
2256	chrome.exe
2840	chrome.exe
3968	chrome.exe
5180	chrome.exe

Loads dropped DLL 54 IoCs

pid	Process
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	discord.com
53	discord.com
56	discord.com

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

persistence privilege_escalation

Internet Connection Discovery

T1016.001

flow	ioc
10	ip-api.com
12	api.ipify.org
13	api.ipify.org
19	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3056	cmd.exe
1252	cmd.exe
5172	cmd.exe
5672	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
5172	cmd.exe
5884	netsh.exe
5672	cmd.exe
5220	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
2320	chrome.exe
4336	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2708	schtasks.exe
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2756	powershell.exe
2756	powershell.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
544	powershell.exe
544	powershell.exe
4048	chrome.exe
4048	chrome.exe
4308	chrome.exe
4308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4048	chrome.exe
4308	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1612	4548	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	83
PID 1612 wrote to memory of 3056	1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3056 wrote to memory of 2708	3056	cmd.exe	91
PID 1612 wrote to memory of 2756	1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 1264 wrote to memory of 3088	1264	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 3088 wrote to memory of 1252	3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 1252 wrote to memory of 4544	1252	cmd.exe	101
PID 3088 wrote to memory of 544	3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 1612 wrote to memory of 4048	1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 4048 wrote to memory of 3956	4048	chrome.exe	105
PID 4048 wrote to memory of 3260	4048	chrome.exe	106
PID 4048 wrote to memory of 2320	4048	chrome.exe	107
PID 4048 wrote to memory of 1992	4048	chrome.exe	108
PID 4048 wrote to memory of 1340	4048	chrome.exe	109
PID 4048 wrote to memory of 1444	4048	chrome.exe	110
PID 4048 wrote to memory of 5036	4048	chrome.exe	111
PID 4048 wrote to memory of 4644	4048	chrome.exe	112
PID 4048 wrote to memory of 1736	4048	chrome.exe	113
PID 4048 wrote to memory of 1088	4048	chrome.exe	114
PID 4048 wrote to memory of 3124	4048	chrome.exe	115
PID 4048 wrote to memory of 3812	4048	chrome.exe	116
PID 4048 wrote to memory of 1236	4048	chrome.exe	118
PID 4048 wrote to memory of 2256	4048	chrome.exe	119
PID 4048 wrote to memory of 2476	4048	chrome.exe	120
PID 4048 wrote to memory of 2148	4048	chrome.exe	121
PID 4048 wrote to memory of 2392	4048	chrome.exe	122
PID 4048 wrote to memory of 2840	4048	chrome.exe	123
PID 3088 wrote to memory of 4308	3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 4308 wrote to memory of 5116	4308	chrome.exe	125
PID 4308 wrote to memory of 2456	4308	chrome.exe	126
PID 4308 wrote to memory of 4336	4308	chrome.exe	127
PID 4308 wrote to memory of 2328	4308	chrome.exe	128
PID 4308 wrote to memory of 3968	4308	chrome.exe	129
PID 4308 wrote to memory of 3944	4308	chrome.exe	130
PID 4308 wrote to memory of 4744	4308	chrome.exe	131
PID 4308 wrote to memory of 4344	4308	chrome.exe	132
PID 4308 wrote to memory of 5180	4308	chrome.exe	134
PID 4308 wrote to memory of 5660	4308	chrome.exe	135
PID 4308 wrote to memory of 5668	4308	chrome.exe	136
PID 4308 wrote to memory of 5676	4308	chrome.exe	137
PID 4308 wrote to memory of 5124	4308	chrome.exe	139
PID 4308 wrote to memory of 5168	4308	chrome.exe	140
PID 4308 wrote to memory of 5496	4308	chrome.exe	141
PID 4308 wrote to memory of 5500	4308	chrome.exe	142
PID 4308 wrote to memory of 5892	4308	chrome.exe	143
PID 4308 wrote to memory of 524	4308	chrome.exe	144
PID 4048 wrote to memory of 5164	4048	chrome.exe	145
PID 4048 wrote to memory of 5176	4048	chrome.exe	146
PID 4048 wrote to memory of 5196	4048	chrome.exe	147
PID 1612 wrote to memory of 6048	1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	148
PID 1612 wrote to memory of 5172	1612	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	150
PID 5172 wrote to memory of 5884	5172	cmd.exe	152
PID 4308 wrote to memory of 5516	4308	chrome.exe	153
PID 4308 wrote to memory of 5632	4308	chrome.exe	154
PID 4308 wrote to memory of 5652	4308	chrome.exe	155
PID 3088 wrote to memory of 5024	3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	156
PID 3088 wrote to memory of 5672	3088	2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	158
PID 5672 wrote to memory of 5220	5672	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /rl highest"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -Ex Bypass -C "Add-Type -AssemblyName System.Device;try{$w=New-Object System.Device.Location.GeoCoordinateWatcher( [System.Device.Location.GeoPositionAccuracy]::High);$w.MovementThreshold=0;$w.Start($true);$rd=[DateTime]::UtcNow.AddSeconds(10);while($w.Status -ne 'Ready' -and [DateTime]::UtcNow -lt $rd){Start-Sleep -Milliseconds 300};if($w.Status -ne 'Ready'){exit 1};$bLat=0;$bLon=0;$bAcc=[double]::MaxValue;$dl=[DateTime]::UtcNow.AddSeconds(45);while([DateTime]::UtcNow -lt $dl){ $c=$w.Position.Location; if(!$c.IsUnknown -and $c.HorizontalAccuracy -lt $bAcc){ $bAcc=$c.HorizontalAccuracy;$bLat=$c.Latitude;$bLon=$c.Longitude };if($bAcc -le 20){break};Start-Sleep -Milliseconds 400};if($bAcc -eq [double]::MaxValue){exit 1};Write-Host \"$bLat|$bLon|$bAcc\"}catch{exit 1}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9738 --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9738 http://127.0.0.1:11854/
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9738 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\_zx9738\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\_zx9738 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff80eccc728,0x7ff80eccc734,0x7ff80eccc740
      4⤵
      PID:3956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
      4⤵
      PID:3260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:3
      4⤵
      System Time Discovery
      PID:2320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
      4⤵
      PID:1992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
      4⤵
      PID:1088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9738 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:8
      4⤵
      PID:5164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
      4⤵
      PID:5176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9738" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,17734982367051545432,11418141416680829146,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:8
      4⤵
      PID:5196
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5884

C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /rl highest"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "SystemName" /sc onlogon /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b26b3f427d42a787dc7fc7d9bd110e0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -Ex Bypass -C "Add-Type -AssemblyName System.Device;try{$w=New-Object System.Device.Location.GeoCoordinateWatcher( [System.Device.Location.GeoPositionAccuracy]::High);$w.MovementThreshold=0;$w.Start($true);$rd=[DateTime]::UtcNow.AddSeconds(10);while($w.Status -ne 'Ready' -and [DateTime]::UtcNow -lt $rd){Start-Sleep -Milliseconds 300};if($w.Status -ne 'Ready'){exit 1};$bLat=0;$bLon=0;$bAcc=[double]::MaxValue;$dl=[DateTime]::UtcNow.AddSeconds(45);while([DateTime]::UtcNow -lt $dl){ $c=$w.Position.Location; if(!$c.IsUnknown -and $c.HorizontalAccuracy -lt $bAcc){ $bAcc=$c.HorizontalAccuracy;$bLat=$c.Latitude;$bLon=$c.Longitude };if($bAcc -le 20){break};Start-Sleep -Milliseconds 400};if($bAcc -eq [double]::MaxValue){exit 1};Write-Host \"$bLat|$bLon|$bAcc\"}catch{exit 1}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9323 --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9323 http://127.0.0.1:10480/
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\_zx9323 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\_zx9323\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\_zx9323 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80eccc728,0x7ff80eccc734,0x7ff80eccc740
      4⤵
      PID:5116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      PID:2456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:3
      4⤵
      System Time Discovery
      PID:4336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
      4⤵
      PID:2328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:5180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
      4⤵
      PID:5660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9323 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
      4⤵
      PID:5516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
      4⤵
      PID:5632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\_zx9323" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,15235679553538762224,7516213984388622422,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
      4⤵
      PID:5652
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process