41ecdf9e1481b9a14369cb6cf4374cb3b859d1148a59a56898654645dfb7b503

System Information Discovery

Processes:

TotalAV_Setup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	TotalAV_Setup.exe

Drops startup file 1 IoCs

Processes:

SecurityService.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gadiuispsal.lnk	SecurityService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

Processes:

TotalAV_Setup.exeTotalAV_Setup.exeSecurityService.exeTotalAV.exeSecurityService.exeSecurityService.exeavupdate.exeavupdate.exeapc_random_id_generator.exeavupdate.exe

pid	process
2004	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
9244	SecurityService.exe
9616	TotalAV.exe
10060	SecurityService.exe
2128	SecurityService.exe
3980	avupdate.exe
9032	avupdate.exe
1740	apc_random_id_generator.exe
9664	avupdate.exe

Loads dropped DLL 64 IoCs

Processes:

TotalAV_Setup.exeTotalAV_Setup.exeSecurityService.exe

pid	process
2004	TotalAV_Setup.exe
2004	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
3248	TotalAV_Setup.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe
9244	SecurityService.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

Processes:

SecurityService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsj4287.tmp\nsRandom.dll	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

SecurityService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	SecurityService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	SecurityService.exe

Checks for any installed AV software in registry 1 TTPs 7 IoCs

Security Software Discovery

T1518.001

Processes:

SecurityService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Wow64_32Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_USERS\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Wow64_32Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_USERS\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus	SecurityService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 29 IoCs

Processes:

SecurityService.exeSecurityService.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\sync	SecurityService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SecurityService\SecurityService_Url_wqsxzqrojlfbwj3xmqn5vi2gsla5q5aq\mqqjidgf.tmp	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\3a544779-0128-4914-9025-93bef4b5b066\Logs.db-journal	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\Web\Host	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_72F8BE6966E415D8C7AFC6FE31E2A14D	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_72F8BE6966E415D8C7AFC6FE31E2A14D	SecurityService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SecurityService\SecurityService_Url_wqsxzqrojlfbwj3xmqn5vi2gsla5q5aq\mqqjidgf.newcfg	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\3a544779-0128-4914-9025-93bef4b5b066\Logs.db	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\System Core	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\ok	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\3a544779-0128-4914-9025-93bef4b5b066\Logs.db	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\Mysa	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\oka	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\TotalAV\vdf_1720024560.zip	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\win defender run	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\3a544779-0128-4914-9025-93bef4b5b066\Logs.db-journal	SecurityService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\TotalAV\vdf_1720024560.zip	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	SecurityService.exe

Drops file in Program Files directory 64 IoCs

Processes:

TotalAV_Setup.exeSecurityService.exeavupdate.exe

description	ioc	process
File created	C:\Program Files (x86)\TotalAV\System.Resources.Extensions.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\aescript.dll	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00044.vdf	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00062.vdf	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00097.vdf	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00187.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\System.Linq.Queryable.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\System.Private.CoreLib.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\Microsoft.Win32.SystemEvents.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\api-ms-win-crt-utility-l1-1-0.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\DotNetZip.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-ysql1b3y.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-dpswvik2.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-2gwijyyn.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00129.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-e52zrdtg.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00239.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\tmp\avupdate_tmp_dObg7v\savapi4-ave2\win32\en\aeheur.dll.gz	avupdate.exe
File created	C:\Program Files (x86)\TotalAV\System.IO.FileSystem.DriveInfo.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\api-ms-win-core-timezone-l1-1-0.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\on_access\win64\win7\avgntflt.sys	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00119.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-s5ev5lq5.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\Nito.Cancellation.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\apcfile.dll	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00206.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\locale\de_DE.mo	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00014.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\System.Xml.ReaderWriter.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\savapiclient.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-1h0ga2iy.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\HBEDV.KEY	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\Branding.Desktop.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\System.Net.ServicePoint.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\System.Runtime.CompilerServices.VisualC.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\tmp\avupdate_tmp_dObg7v\savapi4-ave2\win32\en\aeexp.dll.gz	avupdate.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-x0lrebtb.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00116.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\aelibinf.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\ovpn\libssl-1_1.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\ovpn\openvpn-license.txt	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00079.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-y4yel2sr.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-pemmqpz0.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\System.Diagnostics.DiagnosticSource.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\System.IO.UnmanagedMemoryStream.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-cplyx14d.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\Microsoft.AppCenter.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\driver\i386\OemWin2k.inf	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-puo1yrqj.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-iorr5ase.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-tslvknhy.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\local000.vdf	avupdate.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-zo3o4y5j.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-2jgntowe.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\System.Threading.Thread.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\wpfgfx_cor3.dll	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00001.vdf	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00125.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\PresentationCore.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\System.Drawing.Common.dll	TotalAV_Setup.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00161.vdf	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-zmvtyp1a.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\Nito.AsyncEx.Interop.WaitHandles.dll	TotalAV_Setup.exe

Drops file in Windows directory 12 IoCs

Processes:

SecurityService.exeSecurityService.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\System Core	SecurityService.exe
File opened for modification	C:\Windows\Tasks\Mysa	SecurityService.exe
File opened for modification	C:\Windows\Tasks\oka	SecurityService.exe
File opened for modification	C:\Windows\Help\lsmosee.exe	SecurityService.exe
File opened for modification	C:\Windows\Help\lsmose.exe	SecurityService.exe
File opened for modification	C:\Windows\debug\lsmose.exe	SecurityService.exe
File created	C:\Windows\ELAMBKUP\protected_elam.sys	SecurityService.exe
File opened for modification	C:\Windows\Tasks\Web\Host	SecurityService.exe
File opened for modification	C:\Windows\Tasks\ok	SecurityService.exe
File opened for modification	C:\Windows\debug\lsmosee.exe	SecurityService.exe
File created	C:\Windows\ELAMBKUP\protected_elam.sys	SecurityService.exe
File opened for modification	C:\Windows\Tasks\win defender run	SecurityService.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

9348 sc.exe

pid	process
9348	sc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Program Files (x86)\TotalAV\x86\remediation.dll	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

9504 9244 WerFault.exe

pid	pid_target	process
9504	9244	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a1a8d825d9cc14480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a1a8d8250000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a1a8d825000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da1a8d825000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a1a8d82500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

624 taskkill.exe
2384 taskkill.exe
3904 taskkill.exe

pid	process
624	taskkill.exe
2384	taskkill.exe
3904	taskkill.exe

Modifies data under HKEY_USERS 55 IoCs

Processes:

SecurityService.exeSecurityService.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	SecurityService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	SecurityService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	SecurityService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SecurityService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SecurityService.exe

Modifies registry class 50 IoCs

Processes:

SecurityService.exeSecurityService.exeTotalAV.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\MultiSelectModel = "Single"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\DefaultIcon\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell\open	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{E4BA4655-58DA-474C-969A-6C45ED9B3AC3}\telemetry = "9a72eb71726b4eeeae8cfdafcd764eee9c9978e8"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32	TotalAV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\MultiSelectModel = "Single"	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\command	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\DefaultIcon	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}	TotalAV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\ = "URL:Total AV Protocol"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\MultiSelectModel = "Single"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\SeparatorAfter	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" --custom-scan-context --custom-scan-archives --custom-scan-files=\"%1\" --hide"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\ = "Scan With TotalAV"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\URL Protocol	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\ = "Scan With TotalAV"	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\command	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{E4BA4655-58DA-474C-969A-6C45ED9B3AC3}	SecurityService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" -ToastActivated"	TotalAV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\Position = "Top"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" --custom-scan-context --custom-scan-archives --custom-scan-folders=\"%1\" --hide"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\WOW6432Node	TotalAV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell\open\command	SecurityService.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{7DAE1F89-213C-44E4-895C-16ED7A0F3794}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\Icon = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\WOW6432Node\CLSID	TotalAV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\Icon = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\Position = "Top"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" --custom-scan-context --custom-scan-archives --custom-scan-folders=\"%1\" --hide"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\Icon = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\SeparatorBefore	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\SeparatorAfter	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\SeparatorAfter	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\ = "Scan With TotalAV"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\SeparatorBefore	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\SeparatorBefore	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command\ = "\"%1\" %*"	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\command	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell\open\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" \"%1\""	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV	SecurityService.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 772998.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 772998.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe

pid	process
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

TotalAV_Setup.exe

pid process

3248 TotalAV_Setup.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
3248	TotalAV_Setup.exe

pid	process
656

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs

Processes:

msedge.exemsedge.exe

pid	process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exewmic.exetaskkill.exetaskkill.exetaskkill.exevssvc.exesrtasks.exeSecurityService.exeTotalAV.exeSecurityService.exeSecurityService.exe

description	pid	process
Token: SeDebugPrivilege	1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
Token: SeDebugPrivilege	1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
Token: SeIncreaseQuotaPrivilege	3496	wmic.exe
Token: SeSecurityPrivilege	3496	wmic.exe
Token: SeTakeOwnershipPrivilege	3496	wmic.exe
Token: SeLoadDriverPrivilege	3496	wmic.exe
Token: SeSystemProfilePrivilege	3496	wmic.exe
Token: SeSystemtimePrivilege	3496	wmic.exe
Token: SeProfSingleProcessPrivilege	3496	wmic.exe
Token: SeIncBasePriorityPrivilege	3496	wmic.exe
Token: SeCreatePagefilePrivilege	3496	wmic.exe
Token: SeBackupPrivilege	3496	wmic.exe
Token: SeRestorePrivilege	3496	wmic.exe
Token: SeShutdownPrivilege	3496	wmic.exe
Token: SeDebugPrivilege	3496	wmic.exe
Token: SeSystemEnvironmentPrivilege	3496	wmic.exe
Token: SeRemoteShutdownPrivilege	3496	wmic.exe
Token: SeUndockPrivilege	3496	wmic.exe
Token: SeManageVolumePrivilege	3496	wmic.exe
Token: 33	3496	wmic.exe
Token: 34	3496	wmic.exe
Token: 35	3496	wmic.exe
Token: 36	3496	wmic.exe
Token: SeIncreaseQuotaPrivilege	3496	wmic.exe
Token: SeSecurityPrivilege	3496	wmic.exe
Token: SeTakeOwnershipPrivilege	3496	wmic.exe
Token: SeLoadDriverPrivilege	3496	wmic.exe
Token: SeSystemProfilePrivilege	3496	wmic.exe
Token: SeSystemtimePrivilege	3496	wmic.exe
Token: SeProfSingleProcessPrivilege	3496	wmic.exe
Token: SeIncBasePriorityPrivilege	3496	wmic.exe
Token: SeCreatePagefilePrivilege	3496	wmic.exe
Token: SeBackupPrivilege	3496	wmic.exe
Token: SeRestorePrivilege	3496	wmic.exe
Token: SeShutdownPrivilege	3496	wmic.exe
Token: SeDebugPrivilege	3496	wmic.exe
Token: SeSystemEnvironmentPrivilege	3496	wmic.exe
Token: SeRemoteShutdownPrivilege	3496	wmic.exe
Token: SeUndockPrivilege	3496	wmic.exe
Token: SeManageVolumePrivilege	3496	wmic.exe
Token: 33	3496	wmic.exe
Token: 34	3496	wmic.exe
Token: 35	3496	wmic.exe
Token: 36	3496	wmic.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeBackupPrivilege	448	vssvc.exe
Token: SeRestorePrivilege	448	vssvc.exe
Token: SeAuditPrivilege	448	vssvc.exe
Token: SeBackupPrivilege	3288	srtasks.exe
Token: SeRestorePrivilege	3288	srtasks.exe
Token: SeSecurityPrivilege	3288	srtasks.exe
Token: SeTakeOwnershipPrivilege	3288	srtasks.exe
Token: SeBackupPrivilege	3288	srtasks.exe
Token: SeRestorePrivilege	3288	srtasks.exe
Token: SeSecurityPrivilege	3288	srtasks.exe
Token: SeTakeOwnershipPrivilege	3288	srtasks.exe
Token: SeDebugPrivilege	9244	SecurityService.exe
Token: SeDebugPrivilege	9616	TotalAV.exe
Token: SeDebugPrivilege	10060	SecurityService.exe
Token: SeDebugPrivilege	2128	SecurityService.exe
Token: SeAssignPrimaryTokenPrivilege	2128	SecurityService.exe
Token: SeIncreaseQuotaPrivilege	2128	SecurityService.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exemsedge.exe

pid	process
1360	Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of SendNotifyMessage 51 IoCs

Processes:

msedge.exeTotalAV.exemsedge.exe

pid	process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
9616	TotalAV.exe
9616	TotalAV.exe
9616	TotalAV.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

TotalAV.exe

pid process

9616 TotalAV.exe

pid	process
9616	TotalAV.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2836 wrote to memory of 4552	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 4552	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 3768	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 2052	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 2052	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe
PID 2836 wrote to memory of 1916	2836	msedge.exe	msedge.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

SecurityService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shell = "explorer.exe"	SecurityService.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Cyberpunk 2077 v2.0-v2.1 Plus 46 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa859046f8,0x7ffa85904708,0x7ffa85904718
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5932 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1400 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,9846726907648323026,7458434503852556987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  PID:2876
- C:\Users\Admin\Downloads\TotalAV_Setup.exe
  "C:\Users\Admin\Downloads\TotalAV_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2004
- C:\Users\Admin\Downloads\TotalAV_Setup.exe
  "C:\Users\Admin\Downloads\TotalAV_Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3248
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic.exe path Win32_Process where executablepath="C:\\Program Files (x86)\\TotalAV\\TotalAV.exe" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /f /T /IM "avupdate.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /f /T /IM "Update.Win.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /f /T /IM "PasswordExtension.Win.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Program Files (x86)\TotalAV\SecurityService.exe
    "C:\Program Files (x86)\TotalAV\SecurityService.exe" "--install"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:9244
  - - C:\Windows\SysWOW64\sc.exe
      "sc" create SecurityService start= auto binpath= "\"C:\Program Files (x86)\TotalAV\SecurityService.exe\"" displayname= "PC Security Management Service" obj= LocalSystem password= ""
      4⤵
      Launches sc.exe
      PID:9348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9244 -s 4428
      4⤵
      Program crash
      PID:9504
- - C:\Program Files (x86)\TotalAV\TotalAV.exe
    "C:\Program Files (x86)\TotalAV\TotalAV.exe" --installed --installer="C:\Users\Admin\Downloads\TotalAV_Setup.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:9616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.totalav.com/video?logintoken=Y2I0NTQ5ZmVmMzUwNGEwMWJjYjU4NmM1OWRlOTVmZDRfMTcyMDAyNDU1N0Bwcm90ZWN0ZWQtc2lnbnVwLmNvbTo1M2E0ZmRkNDMzYTJkNWE4NWE3NDYxOGI5ODFhOTUyOGI3NmEyNjQ3OmQzYTY0ZGE4YzA1OWYyNjdkYzUxZmEzZThmZjRhMGU5MjEyNTVlYTJiNDgwOGMxOTA4ZjA2NzUxZDI5ZjQ0MjI6ODUwOTYzMTQ%3D&source=WIN_GUIV2_CREATED_ACCOUNT&action=NONE&sourceGroup=win-app
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of SendNotifyMessage
      PID:3864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffa859046f8,0x7ffa85904708,0x7ffa85904718
        5⤵
        
        PID:9940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        5⤵
        
        PID:456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
        5⤵
        
        PID:6376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
        5⤵
        
        PID:9372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
        5⤵
        
        PID:9408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
        5⤵
        
        PID:4040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5676867373792836760,7856538337080459990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:6928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x46c
1⤵
PID:2376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9244 -ip 9244
1⤵
PID:9480

C:\Program Files (x86)\TotalAV\SecurityService.exe
"C:\Program Files (x86)\TotalAV\SecurityService.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:10060
- C:\Program Files (x86)\TotalAV\SecurityService.exe
  "C:\Program Files (x86)\TotalAV\SecurityService.exe" --run-service --run-service-id=10060
  2⤵
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Drops startup file
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Checks for any installed AV software in registry
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2128
- - C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe
    "C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3980
- - C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe
    "C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net
    3⤵
    - Executes dropped EXE
    PID:9032
- - C:\Program Files (x86)\TotalAV\SAVAPI\apc_random_id_generator.exe
    "C:\Program Files (x86)\TotalAV\SAVAPI\apc_random_id_generator.exe"
    3⤵
    - Executes dropped EXE
    PID:1740
- - C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe
    "C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net
    3⤵
    - Executes dropped EXE
    PID:9664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery