Resubmissions

19-03-2022 08:22

220319-j9qwraech8 10

19-03-2022 08:21

220319-j84ffseebn 6

16-03-2022 15:34

220316-sz9qjsfba4 10

17-02-2022 18:50

220217-xhdn1aedap 10

17-02-2022 13:21

220217-ql2rnsbbf7 10

17-02-2022 13:20

220217-qljwvscdar 1

17-02-2022 13:20

220217-qlb61sbbf6 1

17-02-2022 13:19

220217-qkv8hacdap 1

17-02-2022 12:49

220217-p2gwrscchl 10

17-02-2022 08:03

220217-jxx5ascaan 1

Analysis

  • max time kernel
    451s
  • max time network
    447s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    17-02-2022 13:21

General

  • Target

    important.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Registers COM server for autorun 1 TTPs
  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Downloads MZ/PE file
  • Executes dropped EXE 60 IoCs
  • Sets file execution options in registry 2 TTPs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 41 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\important.exe
    "C:\Users\Admin\AppData\Local\Temp\important.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      2⤵
      • Views/modifies file attributes
      PID:1672
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:1688
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:1104
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 186531645104116.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Windows\SysWOW64\cscript.exe
        cscript.exe //nologo m.vbs
        3⤵
          PID:2192
      • C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
          TaskData\Tor\taskhsvc.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1836
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start /b @[email protected] vs
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Users\Admin\AppData\Local\Temp\@[email protected]
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3672
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3312
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3204
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kovazmlfyf099" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kovazmlfyf099" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
          3⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3628
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:3632
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:3556
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3044
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5916
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5932
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3940
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5672
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5436
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5620
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2192
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:4156
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5724
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1320
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:1104
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5596
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:3272
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5284
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:580
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1568
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:4196
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1704
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:5076
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5732
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:3780
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1212
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:1516
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:5468
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\@[email protected]
      1⤵
        PID:1644
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4784
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        1⤵
        • Adds Run key to start application
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff8edc046f8,0x7ff8edc04708,0x7ff8edc04718
          2⤵
            PID:2108
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
            2⤵
              PID:1936
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5012
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
              2⤵
                PID:4436
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                2⤵
                  PID:3204
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
                  2⤵
                    PID:3568
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                    2⤵
                      PID:1520
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                      2⤵
                        PID:4700
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 /prefetch:8
                        2⤵
                          PID:2984
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
                          2⤵
                            PID:840
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
                            2⤵
                              PID:5176
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5220
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                              2⤵
                                PID:5324
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                                2⤵
                                  PID:5476
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
                                  2⤵
                                    PID:5572
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                                    2⤵
                                      PID:5600
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6732 /prefetch:8
                                      2⤵
                                        PID:5748
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
                                        2⤵
                                          PID:5812
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                                          2⤵
                                            PID:6040
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7132 /prefetch:8
                                            2⤵
                                              PID:5128
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
                                              2⤵
                                                PID:1568
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 /prefetch:8
                                                2⤵
                                                • NTFS ADS
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3092
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6104 /prefetch:8
                                                2⤵
                                                  PID:5768
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1444 /prefetch:8
                                                  2⤵
                                                    PID:5600
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
                                                    2⤵
                                                      PID:1256
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
                                                      2⤵
                                                        PID:5664
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
                                                        2⤵
                                                          PID:3268
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6188 /prefetch:2
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1404
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
                                                          2⤵
                                                            PID:3092
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
                                                            2⤵
                                                              PID:6128
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
                                                              2⤵
                                                                PID:4452
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
                                                                2⤵
                                                                  PID:3644
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7080 /prefetch:8
                                                                  2⤵
                                                                    PID:3556
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
                                                                    2⤵
                                                                      PID:1540
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
                                                                      2⤵
                                                                        PID:812
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
                                                                        2⤵
                                                                          PID:6056
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1
                                                                          2⤵
                                                                            PID:1004
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6720 /prefetch:8
                                                                            2⤵
                                                                              PID:6048
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7908 /prefetch:1
                                                                              2⤵
                                                                                PID:5960
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
                                                                                2⤵
                                                                                  PID:5360
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5152
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
                                                                                    2⤵
                                                                                      PID:1828
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7848 /prefetch:8
                                                                                      2⤵
                                                                                      • NTFS ADS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:3520
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
                                                                                      2⤵
                                                                                        PID:1048
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
                                                                                        2⤵
                                                                                          PID:5568
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11381641314870524211,6175103762426346944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6380 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4172
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:4252
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5184
                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                            1⤵
                                                                                              PID:2284
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca
                                                                                              1⤵
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:5584
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\D3STR0Y3R (test)\D3STR0Y3R.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\D3STR0Y3R (test)\D3STR0Y3R.exe"
                                                                                              1⤵
                                                                                              • Drops file in System32 directory
                                                                                              PID:3780
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c title Welcome!
                                                                                                2⤵
                                                                                                  PID:5936
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c cls
                                                                                                  2⤵
                                                                                                    PID:5388
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c title D3STR0Y3R T00L
                                                                                                    2⤵
                                                                                                      PID:4372
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c cls
                                                                                                      2⤵
                                                                                                        PID:5400
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c title Page 1
                                                                                                        2⤵
                                                                                                          PID:5164
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                                          2⤵
                                                                                                            PID:1404
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c sysdel.bat
                                                                                                            2⤵
                                                                                                              PID:4028
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\elevation_service.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\elevation_service.exe"
                                                                                                            1⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:6072
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6072_1122703294\msedgerecovery.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6072_1122703294\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.62 --sessionid={2e7a25d6-93d4-4825-9b8f-090add4ca265} --system
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:5848
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6072_1122703294\MicrosoftEdgeUpdateSetup.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6072_1122703294\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:4872
                                                                                                                • C:\Program Files (x86)\Microsoft\Temp\EU90B4.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Temp\EU90B4.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:3572
                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                                                    5⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Modifies registry class
                                                                                                                    PID:6048
                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                                                    5⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Modifies registry class
                                                                                                                    PID:6112
                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5676
                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Modifies registry class
                                                                                                                      PID:1256
                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5552
                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTEuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjJBRERCQzEtODVFNy00OTA3LTlBQkYtMEUyNDcxODc4MzdGfSIgdXNlcmlkPSJ7OEFCNTc1RUMtRDg1OC00OTA5LUJFRjAtRENEOEQ4MjA1RDkzfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0U3MDY2NTBDLUQzODYtNDhEMi05QTgwLUM3MjQ4NzZEMzIwMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuMTAwIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE1MS4yNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjg2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                                    5⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:5332
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
                                                                                                                3⤵
                                                                                                                • Loads dropped DLL
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2112
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca
                                                                                                            1⤵
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1900
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                            1⤵
                                                                                                            • Loads dropped DLL
                                                                                                            PID:5356
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
                                                                                                              2⤵
                                                                                                              • Loads dropped DLL
                                                                                                              PID:676
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
                                                                                                                3⤵
                                                                                                                • Loads dropped DLL
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2932
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\D3STR0Y3R (test)\D3STR0Y3R.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Temp1_malware-master.zip\malware-master\D3STR0Y3R (test)\D3STR0Y3R.exe"
                                                                                                            1⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            PID:4048
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c title Welcome!
                                                                                                              2⤵
                                                                                                                PID:2360
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c cls
                                                                                                                2⤵
                                                                                                                  PID:440
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c title D3STR0Y3R T00L
                                                                                                                  2⤵
                                                                                                                    PID:2436
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c cls
                                                                                                                    2⤵
                                                                                                                      PID:5716
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c title Page 1
                                                                                                                      2⤵
                                                                                                                        PID:708
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                                                                        2⤵
                                                                                                                          PID:4676
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ramcrash.bat
                                                                                                                          2⤵
                                                                                                                            PID:3024
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          "C:\Windows\system32\cmd.exe"
                                                                                                                          1⤵
                                                                                                                            PID:4648
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                            1⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:4912
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4283F5A5-8CFD-495F-8C05-132349575053}\MicrosoftEdgeUpdateSetup_X86_1.3.155.77.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4283F5A5-8CFD-495F-8C05-132349575053}\MicrosoftEdgeUpdateSetup_X86_1.3.155.77.exe" /update /sessionid "{C462E3A9-E187-4E9A-B905-47EC7CD4F48F}"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:5316
                                                                                                                              • C:\Program Files (x86)\Microsoft\Temp\EU1A76.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Temp\EU1A76.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{C462E3A9-E187-4E9A-B905-47EC7CD4F48F}"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:4664
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:6072
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:5744
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:5332
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:5544
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:2512
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzQ2MkUzQTktRTE4Ny00RTlBLUI5MDUtNDdFQzdDRDRGNDhGfSIgdXNlcmlkPSJ7OEFCNTc1RUMtRDg1OC00OTA5LUJFRjAtRENEOEQ4MjA1RDkzfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7Qjc1ODNCNDQtQjU4MS00NzExLUE3MjEtNTAzOEFFNTMxMTkzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC4xMDAiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTUxLjI3IiBuZXh0dmVyc2lvbj0iMS4zLjE1NS43NyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjIwN1IiIGluc3RhbGxhZ2U9IjE5NiIgaW5zdGFsbGRhdGV0aW1lPSIxNjI4MTIxMzE2IiBjb2hvcnQ9InJyZkAwLjA5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:4028
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTEuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzQ2MkUzQTktRTE4Ny00RTlBLUI5MDUtNDdFQzdDRDRGNDhGfSIgdXNlcmlkPSJ7OEFCNTc1RUMtRDg1OC00OTA5LUJFRjAtRENEOEQ4MjA1RDkzfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezA2NDA5NjQzLUMyOTUtNENGRi1CMUFELUQyQTVBMzZGRkQ3N30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuMTAwIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE1MS4yNyIgbmV4dHZlcnNpb249IjEuMy4xNTUuNzciIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIyMDdSIiBpbnN0YWxsYWdlPSIxOTYiIGNvaG9ydD0icnJmQDAuMDkiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9jYjFjYmQxMi0xNWNhLTRmZTktOTk0Yi01N2ZkZTVmNTRlNWQ_UDE9MTY0NTcwOTI4MSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1HVWZXcDRSSmVBY3dUdkRId0Z0VENwN1pneThRUEltVGN6VHJENVFuazhiWThIak1kJTJmc3gxSHolMmY1Wmx0a3FFY3Zub0tSdERqdkZYb2NmclptUkYweWclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGRvd25sb2FkZWQ9IjE4MTM0NDgiIHRvdGFsPSIxODEzNDQ4IiBkb3dubG9hZF90aW1lX21zPSIyMzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PHBpbmcgcj0iMTk3IiByZD0iNTMyOSIgcGluZ19mcmVzaG5lc3M9IntCQkVDNDVDQS1BNkNBLTRBMzYtOTg0RS00NUU4QjY1NEMxRjF9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjYyIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgbGFzdF9sYXVuY2hfdGltZT0iMTMyODcxNjIyOTQzOTYxODYiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIyMDYiIHI9IjE5NyIgYWQ9IjUzMjAiIHJkPSI1MzI5IiBwaW5nX2ZyZXNobmVzcz0iezA2Qjc4ODhBLUM3MDEtNDJDMi05OURBLTVGRkY4RTQ1NDcxNH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iOTIuMC45MDIuNjIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBjb2hvcnQ9InJyZkAwLjQyIiBsYXN0X2xhdW5jaF90aW1lPSIxMzI3MTc0NTkxNTA4OTU2MiI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjAiIHI9IjE5NyIgcmQ9IjUzMjkiIHBpbmdfZnJlc2huZXNzPSJ7RTg2NURDQzEtQkQyNS00Mjg2LTg2RTUtMTcxQzY3NjI5MjBFfSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                                                              2⤵
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:4652
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                            1⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:5996
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
                                                                                                                              2⤵
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:5616
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
                                                                                                                                3⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:5940
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                            1⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:5304
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29EB77E4-C962-4E36-9CE4-398B9B5F65EA}\MicrosoftEdge_X64_98.0.1108.55.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29EB77E4-C962-4E36-9CE4-398B9B5F65EA}\MicrosoftEdge_X64_98.0.1108.55.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:6096
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29EB77E4-C962-4E36-9CE4-398B9B5F65EA}\EDGEMITMP_25334.tmp\setup.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29EB77E4-C962-4E36-9CE4-398B9B5F65EA}\EDGEMITMP_25334.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29EB77E4-C962-4E36-9CE4-398B9B5F65EA}\EDGEMITMP_25334.tmp\MSEDGE.PACKED.7Z" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:5400
                                                                                                                          • C:\Windows\system32\LogonUI.exe
                                                                                                                            "LogonUI.exe" /flags:0x4 /state0:0xa3990055 /state1:0x41c64e6d
                                                                                                                            1⤵
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:5264

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • memory/1120-147-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/1836-215-0x0000000073720000-0x0000000073742000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            136KB

                                                                                                                          • memory/1836-216-0x0000000000E10000-0x000000000110E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            3.0MB

                                                                                                                          • memory/1836-214-0x00000000737D0000-0x0000000073852000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            520KB

                                                                                                                          • memory/1836-217-0x0000000073881000-0x00000000738C5000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            272KB

                                                                                                                          • memory/1836-218-0x0000000073501000-0x0000000073676000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.5MB

                                                                                                                          • memory/1836-219-0x00000000737D1000-0x0000000073821000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            320KB

                                                                                                                          • memory/1836-220-0x0000000073721000-0x0000000073734000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            76KB

                                                                                                                          • memory/1836-221-0x0000000000E11000-0x000000000104E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.2MB

                                                                                                                          • memory/1836-213-0x0000000073500000-0x000000007371C000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.1MB

                                                                                                                          • memory/1836-212-0x0000000073880000-0x0000000073902000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            520KB

                                                                                                                          • memory/1936-234-0x00007FF90E580000-0x00007FF90E581000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB