b5b79af08ba0ace6039453e7865b02f36354438f41c99bca4d2d0119437bd433

Analysis

max time kernel
26s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
16-06-2024 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trigger.vbs
Size

883B
MD5

91164fae66119622a7993f35cf72653e
SHA1

7f98b66f8f10c493d27f7e887a41c5661b582195
SHA256

b5b79af08ba0ace6039453e7865b02f36354438f41c99bca4d2d0119437bd433
SHA512

12b2aa61e3989397aed1c758fbeaf52a95ff81322f480693e1c52cb190349273fb852bd8ae860c0776a0aecf7de41043b9a9d121ac46726eeda2ea3033304929

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\Registry\User\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\NotificationData	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5008	vlc.exe
5512	Winword.exe
5512	Winword.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4732	msedge.exe
4732	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5008	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5712	unregmp2.exe
Token: SeCreatePagefilePrivilege	5712	unregmp2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
5008	vlc.exe
5008	vlc.exe
5008	vlc.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
5008	vlc.exe
5008	vlc.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
5008	vlc.exe
5008	vlc.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5008	vlc.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
1544	OpenWith.exe
3060	msedge.exe
5512	Winword.exe
5512	Winword.exe
5512	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4720	2864	WScript.exe	80
PID 2864 wrote to memory of 4720	2864	WScript.exe	80
PID 4440 wrote to memory of 3196	4440	msedge.exe	84
PID 4440 wrote to memory of 3196	4440	msedge.exe	84
PID 4720 wrote to memory of 4952	4720	WScript.exe	85
PID 4720 wrote to memory of 4952	4720	WScript.exe	85
PID 4952 wrote to memory of 684	4952	WScript.exe	86
PID 4952 wrote to memory of 684	4952	WScript.exe	86
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 2792	4440	msedge.exe	90
PID 4440 wrote to memory of 4732	4440	msedge.exe	91
PID 4440 wrote to memory of 4732	4440	msedge.exe	91
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92
PID 4440 wrote to memory of 4560	4440	msedge.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
      4⤵
      Modifies registry class
      PID:684
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        5⤵
        Modifies registry class
        
        PID:2796
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        6⤵
        Modifies registry class
        
        PID:4944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        7⤵
        Modifies registry class
        
        PID:3656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        8⤵
        Modifies registry class
        
        PID:4640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        9⤵
        Modifies registry class
        
        PID:1880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        10⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        11⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        12⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        13⤵
        
        PID:4936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        14⤵
        
        PID:2520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        15⤵
        
        PID:4332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        16⤵
        
        PID:3464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        17⤵
        
        PID:4740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        18⤵
        
        PID:236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        19⤵
        
        PID:4432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        20⤵
        
        PID:5712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        21⤵
        
        PID:1848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        22⤵
        
        PID:3044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        23⤵
        
        PID:5612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        24⤵
        
        PID:6204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        25⤵
        
        PID:6256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        26⤵
        
        PID:6308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        27⤵
        
        PID:6468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        28⤵
        
        PID:6544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        29⤵
        
        PID:6620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        30⤵
        
        PID:6672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        31⤵
        
        PID:6736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        32⤵
        
        PID:6836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        33⤵
        
        PID:6928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        34⤵
        
        PID:7124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        35⤵
        
        PID:5848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        36⤵
        
        PID:6164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        37⤵
        
        PID:6128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        38⤵
        
        PID:6412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        39⤵
        
        PID:5452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        40⤵
        
        PID:5412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        41⤵
        
        PID:5132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        42⤵
        
        PID:6948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        43⤵
        
        PID:6860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        44⤵
        
        PID:6420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        45⤵
        
        PID:5816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        46⤵
        
        PID:5520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        47⤵
        
        PID:244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        48⤵
        
        PID:6808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        49⤵
        
        PID:5576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        50⤵
        
        PID:7212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        51⤵
        
        PID:7276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        52⤵
        
        PID:7340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        53⤵
        
        PID:7392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        54⤵
        
        PID:7456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        55⤵
        
        PID:7556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        56⤵
        
        PID:7616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        57⤵
        
        PID:7692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        58⤵
        
        PID:7860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        59⤵
        
        PID:7924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        60⤵
        
        PID:7976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        61⤵
        
        PID:8028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        62⤵
        
        PID:8084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        63⤵
        
        PID:8132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        64⤵
        
        PID:8184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        65⤵
        
        PID:1468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        66⤵
        
        PID:4992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        67⤵
        
        PID:7504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        68⤵
        
        PID:2076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        69⤵
        
        PID:7788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        70⤵
        
        PID:6084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        71⤵
        
        PID:8112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        72⤵
        
        PID:6228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        73⤵
        
        PID:7852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        74⤵
        
        PID:5624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        75⤵
        
        PID:7644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        76⤵
        
        PID:6648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        77⤵
        
        PID:5388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        78⤵
        
        PID:6616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        79⤵
        
        PID:5728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        80⤵
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        81⤵
        
        PID:7084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        82⤵
        
        PID:4912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        83⤵
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        84⤵
        
        PID:5428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        85⤵
        
        PID:8240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        86⤵
        
        PID:8288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
        87⤵
        
        PID:8360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SelectOpen.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xe0,0x104,0x108,0xb8,0x10c,0x7fff8f1a3cb8,0x7fff8f1a3cc8,0x7fff8f1a3cd8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,10491932875545299554,9663669854720706114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  PID:7016

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompressRename.rm"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1544
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  PID:2396
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  PID:5124
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  PID:5228
- - C:\Program Files (x86)\Windows Media Player\setup_wm.exe
    "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\MergeRestart.jtx"
    3⤵
    PID:5324
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    PID:5352
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:5712
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  PID:5252
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5512
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  PID:4676
- - C:\Program Files (x86)\Windows Media Player\setup_wm.exe
    "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Desktop\MergeRestart.jtx"
    3⤵
    PID:5608
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\MergeRestart.jtx"
  2⤵
  PID:6984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9a91b6dd57fc9c4880d34e9e7c6b760f

SHA1
77a09da6ef4343a8b232386e000cd2d6b9fc30a3

SHA256
0170297f0103d4e415653f86dedc31b0827580042f86862206fd3f6f135b543a

SHA512
9fc3b9be931b3edebc4a6809d62d805046bdceb4c27a7db21cfbbcb0e5e253ab529c54d64e465e60904a6ab3b83156e26b97f852c9526f46f037944f806a7f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bbfb66ff6f5e565ac00d12dbb0f4113d

SHA1
8ee31313329123750487278afb3192d106752f17

SHA256
165401ef4e6bbd51cb89d3f9e6dc13a50132669d5b0229c7db12f2ec3f605754

SHA512
8ea206daabc7895923f3df9798bfd96f459bf859c78f3e5640fad550678b5090539f2a1b590883cd9797efee999acccac16d499772f61f5390e91bcc44d60560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
612B

MD5
34e14800b0ae558956decff4277409b6

SHA1
360042453a3c2ece07f65b1eaed4d6bd26182a52

SHA256
e59bdf4244a0da918a12e174de24996f5b500a72897bb3a114cdcdab6b6c9f3a

SHA512
a0f75c76d289ef755904b41b558459c082219f0659b46ee87a54d846087340eb94d925ec91d3ae624b44f679107c635648ff8d3c63625f529cb80073c0816be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3775f9950711f6682d6fc1ae30f3c83e

SHA1
a88a8d42756a1d66fe77b4ce07dbb4e2e0e5b21c

SHA256
d79cc5be06bb7621c54eac748ee4bf04e2582f390410671a26c15bfa83654b3f

SHA512
01785d5f4774a99ba7eb7dabf4765a70362f9e3d49612d155fe5abbd41e28ef14be3442c0588c5e46bb3e600426b3608e149fdefb67b5027cc8d8c9f64c6467b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f5a1f9d461e524349dacf671b5209c46

SHA1
0508a7d97d074480d944a1fc4256524b65b7fac1

SHA256
5fabe6521c8b0385800e3ad5b4188af0d1866ff2aa5fab0285d74554652421b0

SHA512
2efade199ff243a10e2c80b6f4cb3ffcb8ff989c854799fa8586ec4fe8ddbd5a452b10bc4bc3caca661d5c1c7dbe5d55683053d9f899ea9cce6c5ff965b2c206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
89e560719f440c70a8bd48ab32be72eb

SHA1
fcc02fd936aa1979acfce207cc257f292e4b6edd

SHA256
59078d3fe83eebd049ff6927910fb47dee28229b244bd243b5ce6a7d8a8aa20d

SHA512
f6c3e4a49eb0b416512ce1d7255e42cc0ea97156c11f6dd68b47782fd96f57285c6dbe543fac39cefd5d91f98280f079dd9804bcbabfab0823ebcad7828bf1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
baef25b84f8a41354b74ad3e2e611d60

SHA1
8478f7d6884a8c44d763be9c1955e5313f24880c

SHA256
f3543e3cecbfed000f3dcfb2e21b88ea5224687683753aebd92c7da46489a430

SHA512
4fe5eaf8531fdaedcd6d981e0f5da8d76d32060b93d36085eb1ebfb5467c956beb8e1c4234c119bc341ce19d9487ed689dc8f41f60438bd9375f63a7cc477b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b91e.TMP

Filesize
203B

MD5
63808d3a92016eecffbca61d5a2da106

SHA1
85e68455e74cf79f1db7b2785aae830cc9e393f5

SHA256
ec4f810cf8686de270a85be6991a296c3b4b57c8f667d67d55e1b6d1162e5a57

SHA512
6548b96b8d9e106b9c2f5eda3c3ef98b711ec9fcf7cedcff5dfe599994159138ffe5d6b74eb051eed65c8695c25d3d5dba83bb141dd22caa14cbc96f344a6605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
154070eebae25339530b1c3d8009adb9

SHA1
7ca437a4a28199f9423cd75194fb035b244f73ed

SHA256
0bf351291e47b609cb9d7e34778470a7c7433361417aec396ab3dcc7559bed9d

SHA512
51266f4485587dfb553e77ac8376429ac206ce9dffb6c52f15d392cfaff1faf2118c646c81c77e49397ea7e8c9296c9834f06a6b389e91b84636e6fff0b9c906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bcad6dffad4528bca1e9d8fb3c976798

SHA1
03ec52bab604566549f4fd4a0308b9a8282bbcd6

SHA256
693060b665b9c3b8084518e6e10395e319038eef8f739f85a541f7e85ccb6f1f

SHA512
61751bf6620e57ff8c23f6cb8b43aa5c91bab7ad1da8900935b89a1de8035c1d97e01e08ad8dd97daa505aaa981f75646b5041ad5de77b9c0e8298d0f9768a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
580c0f0d8384b1382e17e9c3c30ef0da

SHA1
2c441a45249d0fb4ef0305c5300bf7f5db67a099

SHA256
519deb4298d9297ff72fb0ee1883df1ecd181f8a0f829b851027c099f469df73

SHA512
fbc3ea35fdb939ccf2562dfdec20984aebf2d74f6183329619fe89ae33e0df30a4580c692a42ba26d815ec5a8b6e0a45f34a5a6fcf2cfda0a47edc16adb04c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
4e15bdb0716491831230225e1834f4a2

SHA1
f6fcb8ef0ba7d17418d3a88816c25e2bb8fca175

SHA256
4a14971b22f10195b12bc775de16e3f33d54ce4219cf1b3fb85d0f2b648dfc33

SHA512
0cce5bf09c32a1ed3b286b41a543237f4d6e89ddaf7c035a5a17790e355b799e15416bca0b240a3186774f39c82dd138b0b173c7dd4341be3cb81d7936ba9fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
a8b0262ece81b5799d63dff3213309dd

SHA1
875021a4476caa96cc27bf04de3a411f98975133

SHA256
435585c8cc32eeb2dd979f645ffe7c83b2ebe296555af4b9b99a387ef9a6a55e

SHA512
e4c5523d6c527c324a7c360bec2a7022874b5b3173acf4fe9bad54590c67c4fecc334d9131f72d5a62617fb375b512b284bfec56fcff0915afa26536155ec18e

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Uh5008

Filesize
1KB

MD5
e5df6ee7742e6e878fd15a540ddef776

SHA1
be3ea708cf854854115ef53c08792dedcb518ce4

SHA256
d5797c5d8501c4df46c86844f8fa2e49f506432da9d4d4effc83245e6b202947

SHA512
26f026f864bb35e3038aa2840447eef6b6ea8dc4bd223195b0190ac9fe2e7d070ed8df68d87d9f499f361e2d6fa6cb54a6feda74be01a2f8f56876c459d6ae50

Download Submit
C:\Users\Admin\Desktop\MergeRemove.xht

Filesize
382KB

MD5
2996446525cb7b38a76d28803c18aaf8

SHA1
7f2a7f1de177e68c40d73579817fb6884bf92329

SHA256
adbb59a8fee79a3588074207f32c201a517de7c984f54b13eedbbdacd2baa426

SHA512
af82ccb183c1786365601f2b29b2af745cc33f97e5b4dde42ab7df1b53f179bda7cf0ec9a974137b9cb80d4f6546b564dd6a50a7730fd118727232d8dd3fcb16

Download Submit
memory/2396-53-0x00007FFF82480000-0x00007FFF82736000-memory.dmp

Filesize
2.7MB

Download
memory/2396-51-0x00007FF6BEE00000-0x00007FF6BEEF8000-memory.dmp

Filesize
992KB

Download
memory/2396-56-0x00007FFF92B40000-0x00007FFF92B51000-memory.dmp

Filesize
68KB

Download
memory/2396-55-0x00007FFF93260000-0x00007FFF93277000-memory.dmp

Filesize
92KB

Download
memory/2396-52-0x00007FFF939F0000-0x00007FFF93A24000-memory.dmp

Filesize
208KB

Download
memory/2396-54-0x00007FFF93970000-0x00007FFF93988000-memory.dmp

Filesize
96KB

Download
memory/5008-35-0x00007FFF80F00000-0x00007FFF8110B000-memory.dmp

Filesize
2.0MB

Download
memory/5008-114-0x00007FFF82480000-0x00007FFF82736000-memory.dmp

Filesize
2.7MB

Download
memory/5008-37-0x00007FFF7FE00000-0x00007FFF80EB0000-memory.dmp

Filesize
16.7MB

Download
memory/5008-40-0x00007FFF7FDB0000-0x00007FFF7FDC1000-memory.dmp

Filesize
68KB

Download
memory/5008-38-0x00007FFF7FDD0000-0x00007FFF7FDF1000-memory.dmp

Filesize
132KB

Download
memory/5008-44-0x000001FF6DC70000-0x000001FF6DC81000-memory.dmp

Filesize
68KB

Download
memory/5008-46-0x00007FFF7FCE0000-0x00007FFF7FD10000-memory.dmp

Filesize
192KB

Download
memory/5008-45-0x00007FFF7FD10000-0x00007FFF7FD28000-memory.dmp

Filesize
96KB

Download
memory/5008-47-0x00007FFF7FC70000-0x00007FFF7FCD7000-memory.dmp

Filesize
412KB

Download
memory/5008-43-0x000001FF6DC50000-0x000001FF6DC6B000-memory.dmp

Filesize
108KB

Download
memory/5008-49-0x00007FFF7FBD0000-0x00007FFF7FBE1000-memory.dmp

Filesize
68KB

Download
memory/5008-26-0x00007FFF939F0000-0x00007FFF93A24000-memory.dmp

Filesize
208KB

Download
memory/5008-48-0x00007FFF7FBF0000-0x00007FFF7FC6C000-memory.dmp

Filesize
496KB

Download
memory/5008-25-0x00007FF6BEE00000-0x00007FF6BEEF8000-memory.dmp

Filesize
992KB

Download
memory/5008-27-0x00007FFF82480000-0x00007FFF82736000-memory.dmp

Filesize
2.7MB

Download
memory/5008-32-0x00007FFF888C0000-0x00007FFF888D1000-memory.dmp

Filesize
68KB

Download
memory/5008-34-0x00007FFF82E50000-0x00007FFF82E61000-memory.dmp

Filesize
68KB

Download
memory/5008-33-0x00007FFF888A0000-0x00007FFF888BD000-memory.dmp

Filesize
116KB

Download
memory/5008-31-0x00007FFF8F060000-0x00007FFF8F077000-memory.dmp

Filesize
92KB

Download
memory/5008-36-0x00007FFF80EB0000-0x00007FFF80EF1000-memory.dmp

Filesize
260KB

Download
memory/5008-30-0x00007FFF92B40000-0x00007FFF92B51000-memory.dmp

Filesize
68KB

Download
memory/5008-29-0x00007FFF93260000-0x00007FFF93277000-memory.dmp

Filesize
92KB

Download
memory/5008-28-0x00007FFF93970000-0x00007FFF93988000-memory.dmp

Filesize
96KB

Download
memory/5008-42-0x000001FF6DC30000-0x000001FF6DC41000-memory.dmp

Filesize
68KB

Download
memory/5008-41-0x000001FF6DC10000-0x000001FF6DC21000-memory.dmp

Filesize
68KB

Download
memory/5008-50-0x00007FFF7FB70000-0x00007FFF7FBC7000-memory.dmp

Filesize
348KB

Download
memory/5008-39-0x00007FFF82E30000-0x00007FFF82E48000-memory.dmp

Filesize
96KB

Download
memory/5124-64-0x00007FFF82480000-0x00007FFF82736000-memory.dmp

Filesize
2.7MB

Download
memory/5124-63-0x00007FFF939F0000-0x00007FFF93A24000-memory.dmp

Filesize
208KB

Download
memory/5124-62-0x00007FF6BEE00000-0x00007FF6BEEF8000-memory.dmp

Filesize
992KB

Download
memory/5124-67-0x00007FFF92B40000-0x00007FFF92B51000-memory.dmp

Filesize
68KB

Download
memory/5124-66-0x00007FFF93260000-0x00007FFF93277000-memory.dmp

Filesize
92KB

Download
memory/5124-65-0x00007FFF93970000-0x00007FFF93988000-memory.dmp

Filesize
96KB

Download
memory/5512-82-0x00007FFF63170000-0x00007FFF63180000-memory.dmp

Filesize
64KB

Download
memory/5512-80-0x00007FFF63170000-0x00007FFF63180000-memory.dmp

Filesize
64KB

Download
memory/5512-81-0x00007FFF63170000-0x00007FFF63180000-memory.dmp

Filesize
64KB

Download
memory/5512-84-0x00007FFF63170000-0x00007FFF63180000-memory.dmp

Filesize
64KB

Download
memory/5512-88-0x00007FFF60800000-0x00007FFF60810000-memory.dmp

Filesize
64KB

Download
memory/5512-83-0x00007FFF63170000-0x00007FFF63180000-memory.dmp

Filesize
64KB

Download
memory/5512-87-0x00007FFF60800000-0x00007FFF60810000-memory.dmp

Filesize
64KB

Download