Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    897s
  • max time network
    898s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    08/02/2025, 11:33

Errors

Reason
Machine shutdown

General

  • Target

    nkth.exe

  • Size

    55KB

  • MD5

    33644523cb6a6c01bbf2dd5c3a97aafc

  • SHA1

    7fd0d35a09a32693d30ffdb49ecd69c1229d2a20

  • SHA256

    e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45

  • SHA512

    43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b

  • SSDEEP

    1536:5EOADn6cpNPmSpVcDGiwsNMDdXExI3pmsm:bADn6cPzLcDGiwsNMDdXExI3pm

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 14 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:588
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:336
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3913055 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:888
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:672
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:960
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
        1⤵
          PID:396
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
          1⤵
            PID:700
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
            1⤵
              PID:656
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
              1⤵
              • Drops file in Windows directory
              PID:1044
              • C:\Windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                2⤵
                  PID:2892
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                1⤵
                • Suspicious use of UnmapMainImage
                PID:1104
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                • Indicator Removal: Clear Windows Event Logs
                PID:1116
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                1⤵
                  PID:1220
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    2⤵
                      PID:2284
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1232
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                      1⤵
                        PID:1256
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                        1⤵
                          PID:1272
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                          1⤵
                            PID:1312
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                            1⤵
                              PID:1408
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                              1⤵
                                PID:1448
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                1⤵
                                  PID:1488
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  PID:1560
                                  • C:\Windows\system32\AUDIODG.EXE
                                    C:\Windows\system32\AUDIODG.EXE 0x4bc 0x538
                                    2⤵
                                      PID:552
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                    1⤵
                                      PID:1600
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                      1⤵
                                        PID:1704
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                        1⤵
                                          PID:1712
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                          1⤵
                                            PID:1768
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                            1⤵
                                              PID:1844
                                            • C:\Windows\System32\spoolsv.exe
                                              C:\Windows\System32\spoolsv.exe
                                              1⤵
                                                PID:1936
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                1⤵
                                                  PID:2040
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                  1⤵
                                                    PID:2056
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                    1⤵
                                                      PID:2064
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                      1⤵
                                                        PID:2244
                                                      • C:\Windows\sysmon.exe
                                                        C:\Windows\sysmon.exe
                                                        1⤵
                                                          PID:2320
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                          1⤵
                                                            PID:2328
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                            1⤵
                                                              PID:2352
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                              1⤵
                                                                PID:2368
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                1⤵
                                                                  PID:2380
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                                  1⤵
                                                                    PID:2464
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                    1⤵
                                                                      PID:2680
                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                      1⤵
                                                                        PID:2920
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                        1⤵
                                                                          PID:1184
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                          1⤵
                                                                            PID:3132
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                            1⤵
                                                                              PID:3268
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:3324
                                                                              • C:\Users\Admin\AppData\Local\Temp\nkth.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\nkth.exe"
                                                                                2⤵
                                                                                • Checks computer location settings
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4556
                                                                                • C:\Users\Admin\AppData\Local\Temp\f6d135d2d686444d9af14597cc47b7d8.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\f6d135d2d686444d9af14597cc47b7d8.exe"
                                                                                  3⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:208
                                                                                  • C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2672
                                                                                  • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3508
                                                                                  • C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3480
                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                    "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
                                                                                    4⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:3892
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC2A.tmp.bat""
                                                                                    4⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2812
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      5⤵
                                                                                        PID:220
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout 3
                                                                                        5⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:1924
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c start shutdown /s /f /t 0
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:404
                                                                                    • C:\Windows\SysWOW64\shutdown.exe
                                                                                      shutdown /s /f /t 0
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4448
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        5⤵
                                                                                          PID:3776
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                  1⤵
                                                                                    PID:3516
                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                    1⤵
                                                                                      PID:3712
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3912
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4128
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                          1⤵
                                                                                            PID:1980
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:5012
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                              1⤵
                                                                                                PID:628
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                1⤵
                                                                                                  PID:4456
                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                  1⤵
                                                                                                    PID:4488
                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4012
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      PID:4872
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:3784
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkM5RUM5MjEtQkI2RC00MTNGLUFFQzktQTFEM0RDMkIzQTdEfSIgdXNlcmlkPSJ7RTA4Rjk2QjAtMDE2NC00NjZDLUFGQUMtN0U2QzVFMjJBMkMzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MUUxRTc0NEQtQjI4Qi00RDMwLThEQUItRDMwODE1Q0UwNUQ5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTE2NTY4NjI2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                        1⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                        PID:2472
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\MicrosoftEdge_X64_132.0.2957.140.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                        1⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5028
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                          2⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Executes dropped EXE
                                                                                                          • Installs/modifies Browser Helper Object
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          • System policy modification
                                                                                                          PID:4404
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7458ca818,0x7ff7458ca824,0x7ff7458ca830
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:1664
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3184
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7458ca818,0x7ff7458ca824,0x7ff7458ca830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:3396
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1212
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78871a818,0x7ff78871a824,0x7ff78871a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:3924
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2664
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78871a818,0x7ff78871a824,0x7ff78871a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:3356
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Program Files directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4192
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78871a818,0x7ff78871a824,0x7ff78871a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:320
                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                        C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                                                                                                        1⤵
                                                                                                          PID:4896
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4608
                                                                                                            • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                                                                                                              "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:4616
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                            1⤵
                                                                                                              PID:440
                                                                                                            • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                              C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:3424
                                                                                                              • C:\Windows\system32\wwahost.exe
                                                                                                                "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                                                                                                                1⤵
                                                                                                                • Modifies Internet Explorer settings
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:4436
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkM5RUM5MjEtQkI2RC00MTNGLUFFQzktQTFEM0RDMkIzQTdEfSIgdXNlcmlkPSJ7RTA4Rjk2QjAtMDE2NC00NjZDLUFGQUMtN0U2QzVFMjJBMkMzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InszMkEwMTZFQi1BQkVGLTQ0NEItQjRENi1ENjc0OEQ4QTZERUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGNvaG9ydD0icnJmQDAuMjciPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7RjVBRUEzNTEtMDI3MC00MzM0LTkwMkQtRkQ2RjlBMDEwMjMyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzQyNTUyMTYwMzA5MzAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTE4ODA4MTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE5MTg4MDgxMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE2NTQ3NDk1MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NjE5NzQxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVl5dHl1TGpma2VyRUNXcDJVT3l2Q2FERDRnVnY5SW5obiUyZmJ0STBEVWFTR0lNMHV1JTJiM0YlMmZLTVVlRm1Kd1JEMmJ6MGkyUnBXVHdyMjcxRFBQNXNraHhRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE2NTQ3NDk1MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk2MTk3NDEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9WXl0eXVMamZrZXJFQ1dwMlVPeXZDYURENGdWdjlJbmhuJTJmYnRJMERVYVNHSU0wdXUlMmIzRiUyZktNVWVGbUp3UkQyYnowaTJScFdUd3IyNzFEUFA1c2toeFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjkxMjgxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNjU0NzQ5NTEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE3OTA2ODQxOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjcyODkxMjQ3NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY5MjIiIGRvd25sb2FkX3RpbWVfbXM9Ijk3MzU5IiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjU0OTg1Ii8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNjYxMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7MEJBNkIyMkEtN0QxNi00OTUzLTg2NDAtNDVBRTc3NkYzN0U4fSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NjA4IiBjb2hvcnQ9InJyZkAwLjkyIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjEiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0ie0I5OEQ3OUE1LTZGMTAtNEIzNi04RTQ1LUUxREYzMjQ3NUZCOX0iLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                                1⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                PID:1728

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DCC3D7B7-5D2E-4DF2-A9A9-587C6F89A58A}\EDGEMITMP_043B6.tmp\setup.exe

                                                                                                                Filesize

                                                                                                                6.6MB

                                                                                                                MD5

                                                                                                                b4c8ad75087b8634d4f04dc6f92da9aa

                                                                                                                SHA1

                                                                                                                7efaa2472521c79d58c4ef18a258cc573704fb5d

                                                                                                                SHA256

                                                                                                                522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

                                                                                                                SHA512

                                                                                                                5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

                                                                                                                Filesize

                                                                                                                3.7MB

                                                                                                                MD5

                                                                                                                3646786aea064c0845f5bb1b8e976985

                                                                                                                SHA1

                                                                                                                a31ba2d2192898d4c0a01511395bdf87b0e53873

                                                                                                                SHA256

                                                                                                                a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

                                                                                                                SHA512

                                                                                                                145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

                                                                                                              • C:\Program Files\msedge_installer.log

                                                                                                                Filesize

                                                                                                                70KB

                                                                                                                MD5

                                                                                                                3e45777445d9e9145b9d3eecf25c61e2

                                                                                                                SHA1

                                                                                                                404de6362c61a1a0f1de16e05d1979bd03282ebc

                                                                                                                SHA256

                                                                                                                d7f83620d8375458aa37ef39c074126077e81f937ce87b74a845715b6bafa668

                                                                                                                SHA512

                                                                                                                ee6967fdace1157bfa654828f65860c892aeaeaacb00a0a0c8c8492986d9ba941bc88ac26b4b3046436887fe479196691ea23c199ddba69325ac2007294ed25d

                                                                                                              • C:\Program Files\msedge_installer.log

                                                                                                                Filesize

                                                                                                                97KB

                                                                                                                MD5

                                                                                                                f2a7b2f2f88ed4470763ec09891d8aeb

                                                                                                                SHA1

                                                                                                                5a7ff00e378844bc4fcc9e5960bf5d005e91b155

                                                                                                                SHA256

                                                                                                                c13b042841686f20baf42e7a89260752d02a8dcb41097c1c397a41ec35d535a6

                                                                                                                SHA512

                                                                                                                4fb21724d6b559c157a85d27d7955837e616c52feb076b7f3f4b089692ebb576f72b781a472a15e4ec7b60b341fa98d960dd32bf776bd2fa46f72baa61800ece

                                                                                                              • C:\Program Files\msedge_installer.log

                                                                                                                Filesize

                                                                                                                100KB

                                                                                                                MD5

                                                                                                                90a3c3db79cca005e34c7b9218df6497

                                                                                                                SHA1

                                                                                                                6f26b8aa52cbb242d474e9ce8a00f8423d70b15f

                                                                                                                SHA256

                                                                                                                00a5d97693403632d43409f1f91f7df4fad631c00f71d278981cd099d5156138

                                                                                                                SHA512

                                                                                                                be95f62c80d8874160c398ba721de97564a052dedf2f038028446b28ea96f4665a8f55513609ad3f4a9336271f3585b62ef7f16879ef9256f4862276de262006

                                                                                                              • C:\Program Files\msedge_installer.log

                                                                                                                Filesize

                                                                                                                102KB

                                                                                                                MD5

                                                                                                                5e6a699d52d4e1aa7296c36f2be7f8fc

                                                                                                                SHA1

                                                                                                                243849fa6dee3fda4b9d03a3fbdc14a79624eec4

                                                                                                                SHA256

                                                                                                                af7b7f2954f84d3992d333c98be647888a903cc9a5407cf07c1256b56ca17b48

                                                                                                                SHA512

                                                                                                                c9a18e92827321c1bd3acca0b4a241bebca439d3c6f87335c42c2c9e96e9b1c1617162b49e7e5e4fa7dfdc89e11ad5d084ca52c8dbdff1ce49e869eb03b1ab40

                                                                                                              • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                                                                                Filesize

                                                                                                                590KB

                                                                                                                MD5

                                                                                                                f731ac7323d882f563d6a1b79899ff6a

                                                                                                                SHA1

                                                                                                                4b680f3ccb3789c43a291088db6d6d7345162d65

                                                                                                                SHA256

                                                                                                                97a0f1ceba9454926d0153fb8b76959d5fe9064cfed483da918a9ae1e2c5b4c9

                                                                                                                SHA512

                                                                                                                16b32b81907e16ba9c8fdd2519f4075fd73e927a1057b97bab40e612197a6fb5cd8508c793dfc76f98f1fba30dab595e2094653bb737d77d9bcbd61080d3bbc5

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe

                                                                                                                Filesize

                                                                                                                61KB

                                                                                                                MD5

                                                                                                                2f9823efd49a6f8fc32ba52d75e620a4

                                                                                                                SHA1

                                                                                                                39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e

                                                                                                                SHA256

                                                                                                                57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6

                                                                                                                SHA512

                                                                                                                2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe

                                                                                                                Filesize

                                                                                                                65KB

                                                                                                                MD5

                                                                                                                f006d2343d121bd2043925e87063fde7

                                                                                                                SHA1

                                                                                                                402799473ca52edb826a37e0042456032db121f3

                                                                                                                SHA256

                                                                                                                de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93

                                                                                                                SHA512

                                                                                                                707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe

                                                                                                                Filesize

                                                                                                                161KB

                                                                                                                MD5

                                                                                                                94f1ab3a068f83b32639579ec9c5d025

                                                                                                                SHA1

                                                                                                                38f3d5bc5de46feb8de093d11329766b8e2054ae

                                                                                                                SHA256

                                                                                                                879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0

                                                                                                                SHA512

                                                                                                                44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f6d135d2d686444d9af14597cc47b7d8.exe

                                                                                                                Filesize

                                                                                                                535KB

                                                                                                                MD5

                                                                                                                82bf26203c5d76dfa3a591f1cb60d7b5

                                                                                                                SHA1

                                                                                                                93bf418f64ec701fd0d3232a00a167d04ba9a6d2

                                                                                                                SHA256

                                                                                                                2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d

                                                                                                                SHA512

                                                                                                                6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpEC2A.tmp.bat

                                                                                                                Filesize

                                                                                                                184B

                                                                                                                MD5

                                                                                                                bcbaefd70aac7c4859b07a8c8252fca9

                                                                                                                SHA1

                                                                                                                512881a70d7c662f106b895e28696a799e4dc293

                                                                                                                SHA256

                                                                                                                a9ec64d5cf4cbd23bf71227c4936405375b78c1b5de753b8eeba20780012b6a3

                                                                                                                SHA512

                                                                                                                c2a059ffff44144603ccd2309853ccf34f18826e677b6e98bdbc1003367349d1f23438ac59be9955a8be11e410410cec0e098d3c2b30c9c416565b57b2002f69

                                                                                                              • memory/208-438-0x0000000000E30000-0x0000000000EBC000-memory.dmp

                                                                                                                Filesize

                                                                                                                560KB

                                                                                                              • memory/208-439-0x0000000002F40000-0x0000000002F82000-memory.dmp

                                                                                                                Filesize

                                                                                                                264KB

                                                                                                              • memory/336-489-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/336-488-0x000002011B930000-0x000002011B95B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/396-496-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/396-495-0x00000151AB660000-0x00000151AB68B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/588-474-0x000001964AEE0000-0x000001964AF0B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/588-473-0x000001964AEB0000-0x000001964AED5000-memory.dmp

                                                                                                                Filesize

                                                                                                                148KB

                                                                                                              • memory/588-475-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/656-504-0x0000025398E90000-0x0000025398EBB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/656-505-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/672-478-0x0000020C11330000-0x0000020C1135B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/672-479-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/700-499-0x000001B811130000-0x000001B81115B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/700-500-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/960-492-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/960-491-0x00000211C33D0000-0x00000211C33FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1044-508-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1044-507-0x00000265F4160000-0x00000265F418B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1104-516-0x000002CBA6570000-0x000002CBA659B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1104-517-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1116-519-0x000002A281760000-0x000002A28178B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1116-520-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1220-523-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1220-522-0x000001C9315B0000-0x000001C9315DB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1232-529-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1232-528-0x00000206CC4C0000-0x00000206CC4EB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1256-531-0x000002A0A9BA0000-0x000002A0A9BCB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1256-532-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1272-534-0x00000201723D0000-0x00000201723FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1272-535-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1312-539-0x0000022543F30000-0x0000022543F5B000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/1312-540-0x00007FFE82C50000-0x00007FFE82C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                              • memory/1408-542-0x000002641A590000-0x000002641A5BB000-memory.dmp

                                                                                                                Filesize

                                                                                                                172KB

                                                                                                              • memory/2672-458-0x00000000002D0000-0x00000000002E6000-memory.dmp

                                                                                                                Filesize

                                                                                                                88KB

                                                                                                              • memory/3480-545-0x0000000000A10000-0x0000000000A26000-memory.dmp

                                                                                                                Filesize

                                                                                                                88KB

                                                                                                              • memory/3480-583-0x0000000005B70000-0x0000000005C02000-memory.dmp

                                                                                                                Filesize

                                                                                                                584KB

                                                                                                              • memory/3508-472-0x00007FFEC2530000-0x00007FFEC25EE000-memory.dmp

                                                                                                                Filesize

                                                                                                                760KB

                                                                                                              • memory/3508-466-0x00007FFEC2BD0000-0x00007FFEC2DC5000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.0MB

                                                                                                              • memory/4556-4-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-5-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-779-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-3-0x0000000073922000-0x0000000073923000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4556-6-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-7-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-1-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-2-0x0000000073920000-0x0000000073ED1000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.7MB

                                                                                                              • memory/4556-0-0x0000000073922000-0x0000000073923000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4616-67-0x000001BF24DD0000-0x000001BF24DDA000-memory.dmp

                                                                                                                Filesize

                                                                                                                40KB

                                                                                                              • memory/4616-123-0x000001BF26990000-0x000001BF269ED000-memory.dmp

                                                                                                                Filesize

                                                                                                                372KB

                                                                                                              • memory/4616-66-0x000001BF0AC00000-0x000001BF0AC0E000-memory.dmp

                                                                                                                Filesize

                                                                                                                56KB

                                                                                                              • memory/4616-69-0x000001BF263B0000-0x000001BF265F9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                              • memory/4616-68-0x000001BF26340000-0x000001BF26348000-memory.dmp

                                                                                                                Filesize

                                                                                                                32KB