Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

nkth.exe

windows11-21h2-x64

10

nkth.exe

windows7-x64

nkth.exe

windows10-2004-x64

nkth.exe

windows10-ltsc 2021-x64

nkth.exe

windows11-21h2-x64

Analysis

  • max time kernel
    893s
  • max time network
    894s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250207-de
  • resource tags

    arch:x64arch:x86image:win11-20250207-delocale:de-deos:windows11-21h2-x64systemwindows
  • submitted
    08/02/2025, 11:33

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    nkth.exe

  • Size

    55KB

  • MD5

    33644523cb6a6c01bbf2dd5c3a97aafc

  • SHA1

    7fd0d35a09a32693d30ffdb49ecd69c1229d2a20

  • SHA256

    e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45

  • SHA512

    43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b

  • SSDEEP

    1536:5EOADn6cpNPmSpVcDGiwsNMDdXExI3pmsm:bADn6cPzLcDGiwsNMDdXExI3pm

Score
10/10
njratadwaredefense_evasiondiscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 14 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:616
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:404
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3a27855 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:3000
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:704
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:996
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
        1⤵
          PID:656
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
          1⤵
            PID:844
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
            1⤵
              PID:1032
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
              1⤵
              • Drops file in Windows directory
              PID:1104
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1588
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
              1⤵
                PID:1124
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                1⤵
                  PID:1144
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                  1⤵
                    PID:1168
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                    1⤵
                      PID:1244
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        2⤵
                          PID:3148
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                        • Indicator Removal: Clear Windows Event Logs
                        PID:1272
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                        1⤵
                          PID:1300
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                          1⤵
                            PID:1308
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                            1⤵
                              PID:1464
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                              1⤵
                                PID:1524
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                1⤵
                                  PID:1560
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                  1⤵
                                    PID:1600
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E0
                                      2⤵
                                        PID:4032
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                      1⤵
                                        PID:1680
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                        1⤵
                                          PID:1692
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1712
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                            1⤵
                                              PID:1804
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                              1⤵
                                              • Suspicious use of UnmapMainImage
                                              PID:1832
                                            • C:\Windows\System32\spoolsv.exe
                                              C:\Windows\System32\spoolsv.exe
                                              1⤵
                                                PID:1992
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                1⤵
                                                  PID:2052
                                                • C:\Windows\sysmon.exe
                                                  C:\Windows\sysmon.exe
                                                  1⤵
                                                    PID:2168
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p
                                                    1⤵
                                                      PID:2176
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                      1⤵
                                                        PID:2184
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                        1⤵
                                                          PID:2208
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                          1⤵
                                                            PID:2216
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                            1⤵
                                                              PID:2244
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2252
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                  PID:2264
                                                                • C:\Windows\system32\wbem\unsecapp.exe
                                                                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                  1⤵
                                                                    PID:2692
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                                    1⤵
                                                                      PID:3028
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                      1⤵
                                                                        PID:2388
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                        1⤵
                                                                          PID:3176
                                                                        • C:\Windows\Explorer.EXE
                                                                          C:\Windows\Explorer.EXE
                                                                          1⤵
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:3332
                                                                          • C:\Users\Admin\AppData\Local\Temp\nkth.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\nkth.exe"
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1920
                                                                            • C:\Users\Admin\AppData\Local\Temp\61404fe0251941d081b0c58c6117dacc.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\61404fe0251941d081b0c58c6117dacc.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2716
                                                                              • C:\Windows\System32\schtasks.exe
                                                                                "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
                                                                                4⤵
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:4552
                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:3996
                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3992
                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:544
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c start shutdown /s /f /t 0
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4000
                                                                              • C:\Windows\SysWOW64\shutdown.exe
                                                                                shutdown /s /f /t 0
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2340
                                                                                • C:\Windows\System32\Conhost.exe
                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  5⤵
                                                                                    PID:992
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                            1⤵
                                                                              PID:3472
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                              1⤵
                                                                                PID:3520
                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                1⤵
                                                                                  PID:3912
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                  1⤵
                                                                                    PID:3960
                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                    1⤵
                                                                                      PID:4024
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                      1⤵
                                                                                        PID:4084
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                        1⤵
                                                                                          PID:4296
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                          1⤵
                                                                                          • Suspicious use of UnmapMainImage
                                                                                          PID:4436
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                          1⤵
                                                                                            PID:4840
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:3324
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                              1⤵
                                                                                                PID:2108
                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                1⤵
                                                                                                  PID:4256
                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:4708
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:4040
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      PID:2712
                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUFCNDBBNjktODU4NC00ODM1LTkxOTAtNUFBQjY0MThCODhEfSIgdXNlcmlkPSJ7M0VFQUExMUUtNDA5Ny00ODQyLUIwRjYtQUU4NTdDMjM2NUZBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NThBN0Q2NjAtMTQ3RC00NDBDLThFODMtNUU0N0EwRDQ0NUZDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1MTk2MCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI0NTQ1NjU5MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMTk4ODE1MzQiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                      1⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                      PID:3136
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                      1⤵
                                                                                                        PID:3984
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\MicrosoftEdge_X64_132.0.2957.140.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                        1⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1364
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                          2⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Executes dropped EXE
                                                                                                          • Installs/modifies Browser Helper Object
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          • System policy modification
                                                                                                          PID:2848
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff76513a818,0x7ff76513a824,0x7ff76513a830
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:1176
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4008
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff76513a818,0x7ff76513a824,0x7ff76513a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:4992
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3364
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff64170a818,0x7ff64170a824,0x7ff64170a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:1768
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1460
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff64170a818,0x7ff64170a824,0x7ff64170a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:3384
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:476
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff64170a818,0x7ff64170a824,0x7ff64170a830
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:488
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUFCNDBBNjktODU4NC00ODM1LTkxOTAtNUFBQjY0MThCODhEfSIgdXNlcmlkPSJ7M0VFQUExMUUtNDA5Ny00ODQyLUIwRjYtQUU4NTdDMjM2NUZBfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxQTQ3RDQyRi1DMEU1LTQxNDMtQjAxQy04N0M4OTk1QkQzMjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40MSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins0QkMzNDE5RC04NjJGLTRFQkMtOTQ3Ni1FQzJBRTI4Q0Y1QUZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNDMxNjAwMzQ3MjQ0MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEzODc4Nzk4OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTM4Nzg3OTg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDE0NzUzODIxOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NjE5NzExJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUlpYkNnVlRmSFhjY0RFQTVHNE1RdVRzWFdJOThjNWc0d2NXSU1XSnNoUXlXYWhrSnNJQWdkeiUyZlBnYmRpUyUyYlFVUnNBaTVRSUVGUXBUNHpqVmRrTTI2dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMTQ3NTM4MjE5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTYxOTcxMSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1JaWJDZ1ZUZkhYY2NERUE1RzRNUXVUc1hXSTk4YzVnNHdjV0lNV0pzaFF5V2Foa0pzSUFnZHolMmZQZ2JkaVMlMmJRVVJzQWk1UUlFRlFwVDR6alZka00yNnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjQ5NDM0MyIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDE0NzY5NDMwMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDE2MTI4ODU1NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA2OTM2MzI0NjYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMTEwIiBkb3dubG9hZF90aW1lX21zPSI1MDA4OTAiIGRvd25sb2FkZWQ9IjE3NzE4MDIxNiIgdG90YWw9IjE3NzE4MDIxNiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNTMyMzQiLz48cGluZyBhY3RpdmU9IjEiIGE9IjEiIHI9IjEiIGFkPSI2NjEyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins5RUYxOEVGNi1GQ0E0LTQzOTEtQkU2Ri03NzZENUIyRkZERUV9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40MSIgdXBkYXRlX2NvdW50PSIxIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjEiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezU5QkZEOTkwLTc2OTktNDRFRC05RDI3LUEzM0FENkVDMUY4NH0iLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                        1⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                        PID:2708

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Reconnaissance

                                                                                                      Resource Development

                                                                                                      Initial Access

                                                                                                      Execution

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Persistence

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Active Setup

                                                                                                      1
                                                                                                      T1547.014

                                                                                                      Browser Extensions

                                                                                                      1
                                                                                                      T1176

                                                                                                      Event Triggered Execution

                                                                                                      1
                                                                                                      T1546

                                                                                                      Component Object Model Hijacking

                                                                                                      1
                                                                                                      T1546.015

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Privilege Escalation

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Active Setup

                                                                                                      1
                                                                                                      T1547.014

                                                                                                      Event Triggered Execution

                                                                                                      1
                                                                                                      T1546

                                                                                                      Component Object Model Hijacking

                                                                                                      1
                                                                                                      T1546.015

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Defense Evasion

                                                                                                      Indicator Removal

                                                                                                      1
                                                                                                      T1070

                                                                                                      Clear Windows Event Logs

                                                                                                      1
                                                                                                      T1070.001

                                                                                                      Modify Registry

                                                                                                      4
                                                                                                      T1112

                                                                                                      Credential Access

                                                                                                      Discovery

                                                                                                      Query Registry

                                                                                                      2
                                                                                                      T1012

                                                                                                      System Information Discovery

                                                                                                      1
                                                                                                      T1082

                                                                                                      System Location Discovery

                                                                                                      1
                                                                                                      T1614

                                                                                                      System Language Discovery

                                                                                                      1
                                                                                                      T1614.001

                                                                                                      System Network Configuration Discovery

                                                                                                      1
                                                                                                      T1016

                                                                                                      Internet Connection Discovery

                                                                                                      1
                                                                                                      T1016.001

                                                                                                      Lateral Movement

                                                                                                      Collection

                                                                                                      Command and Control

                                                                                                      Exfiltration

                                                                                                      Impact

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{65CA0981-C664-4A91-856B-6784B9522F71}\EDGEMITMP_D32E9.tmp\setup.exe
                                                                                                        Filesize

                                                                                                        6.6MB

                                                                                                        MD5

                                                                                                        b4c8ad75087b8634d4f04dc6f92da9aa

                                                                                                        SHA1

                                                                                                        7efaa2472521c79d58c4ef18a258cc573704fb5d

                                                                                                        SHA256

                                                                                                        522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

                                                                                                        SHA512

                                                                                                        5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

                                                                                                        Download Submit

                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        Filesize

                                                                                                        3.7MB

                                                                                                        MD5

                                                                                                        3646786aea064c0845f5bb1b8e976985

                                                                                                        SHA1

                                                                                                        a31ba2d2192898d4c0a01511395bdf87b0e53873

                                                                                                        SHA256

                                                                                                        a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

                                                                                                        SHA512

                                                                                                        145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

                                                                                                        Download Submit

                                                                                                      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                                        Filesize

                                                                                                        850KB

                                                                                                        MD5

                                                                                                        88724406869ecbabcb710244d65577b3

                                                                                                        SHA1

                                                                                                        4030d6122d936427401808147f4868447b100c56

                                                                                                        SHA256

                                                                                                        62850790a3675ee7fed856ac14e4b434fcef91bfa6bb642d332afeb826cc2cfc

                                                                                                        SHA512

                                                                                                        94149277071576581ba96230173e2d5c986962810da1fbf9cf4fd72f8a58c4bb3c62366630c8953d269e1ad155e62c59ed487a3c50b3cc7799dccf3e8a49c81c

                                                                                                        Download Submit

                                                                                                      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                                        Filesize

                                                                                                        858KB

                                                                                                        MD5

                                                                                                        b4d474a4f4a7bd0af2c6c5cc0d07d912

                                                                                                        SHA1

                                                                                                        be591c4bf0c13fc54bd38a90d8e91a898bc24d4b

                                                                                                        SHA256

                                                                                                        9cf2b05bee1a9766ebb663bd7e1d63ca5bcef8e8ee4dcb40ae0f50bec67d1011

                                                                                                        SHA512

                                                                                                        7a580bdb2eb544b0760eff417402c4cec2a5d1a535f5936b1c26a0cef7f9a45b35692275e7b1a7ea37918540301ddc5d591d71ab49de22e4ed46588aa8cdd82c

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61404fe0251941d081b0c58c6117dacc.exe
                                                                                                        Filesize

                                                                                                        482KB

                                                                                                        MD5

                                                                                                        85e11c1d67aec0150757e3255d8231b7

                                                                                                        SHA1

                                                                                                        9167c5ea4a23d59f38e82f128f2b1a2dbbd88cea

                                                                                                        SHA256

                                                                                                        b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588

                                                                                                        SHA512

                                                                                                        a25fcf6c359a00e5671b08dbf91fde79fe14e9720d8d8b4980584fbb32f9bba78a8cc8760e5c504fad894e34df1d2693bd1d161539ad4597df3c50c84c1c5e51

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
                                                                                                        Filesize

                                                                                                        147KB

                                                                                                        MD5

                                                                                                        fd138f51961f3071e135dae4e279ca7d

                                                                                                        SHA1

                                                                                                        63a107425ab4b3515b4c6545076ac6721a459717

                                                                                                        SHA256

                                                                                                        24f189af6d0c0af7dbdbf230183423d34d9cc3c06f55fa911145dcc19e3a6eb6

                                                                                                        SHA512

                                                                                                        f0d596ebe25c89907018f4d5ca4635df28c7f7095c81bd4d6f6b0819301bd113fb2469d643c02b5d41f2ce523e8539c1a97a817160ee0074d6e1f0a7951e7804

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe
                                                                                                        Filesize

                                                                                                        58KB

                                                                                                        MD5

                                                                                                        1b120dcde4b7be948179d53257c71423

                                                                                                        SHA1

                                                                                                        efd894e18d8d9eb8b0af9e8eeaa0d44be04a7b62

                                                                                                        SHA256

                                                                                                        34c657218a5d7702de283691e868f61c1f50ffcd9e6c6bd3f0336bda904975aa

                                                                                                        SHA512

                                                                                                        fb5ac3cdc836926919710edb15f0e4cb54a72f74122566ac2a965efb1b36daa94cdf01b4b984203d0d4c0deb0791f65d20d675029b40fa7e1baafd3194e4dbfe

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                        Filesize

                                                                                                        161KB

                                                                                                        MD5

                                                                                                        94f1ab3a068f83b32639579ec9c5d025

                                                                                                        SHA1

                                                                                                        38f3d5bc5de46feb8de093d11329766b8e2054ae

                                                                                                        SHA256

                                                                                                        879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0

                                                                                                        SHA512

                                                                                                        44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

                                                                                                        Download Submit

                                                                                                      • C:\Windows\SystemTemp\msedge_installer.log
                                                                                                        Filesize

                                                                                                        72KB

                                                                                                        MD5

                                                                                                        19fca7d8d3146928a3cd8a66e4964cc1

                                                                                                        SHA1

                                                                                                        580703c5c1fc3eb0a0678a8a6281de0667de9905

                                                                                                        SHA256

                                                                                                        f575c1323849412c59b9842f563700cb48e0645e73816418c4c380be186ac869

                                                                                                        SHA512

                                                                                                        5fda4423fd31794fd876313d8661d3b0d888ea2406e04e866e5f476071ebaa748b9230e5966f6a3c51f79d89a2d4a0726343da06de46dabd23506fc80364ecf5

                                                                                                        Download Submit

                                                                                                      • C:\Windows\SystemTemp\msedge_installer.log
                                                                                                        Filesize

                                                                                                        99KB

                                                                                                        MD5

                                                                                                        59c0e0c790cd241766831e8924d81246

                                                                                                        SHA1

                                                                                                        e1b7e6ba31676f220b4049aa4c8614e19e857a06

                                                                                                        SHA256

                                                                                                        f5490dbcdb47c5c87c0d30e430e00cf4073aeab90a6f3b0c49683e1b2d4bd5cd

                                                                                                        SHA512

                                                                                                        09bd1a18fcd9b38cdc68c68c73b76d919421776aa0f20b29bb4725ce3e6d7812d5909c2a7593119d77b7d598cfbdf85772c7a9d5b5a5b0ea851e982d4bc7562f

                                                                                                        Download Submit

                                                                                                      • C:\Windows\SystemTemp\msedge_installer.log
                                                                                                        Filesize

                                                                                                        103KB

                                                                                                        MD5

                                                                                                        9bdce904059373f9db20c998399b64aa

                                                                                                        SHA1

                                                                                                        de77952e0098814dfa98c5e3d97df2a89476e064

                                                                                                        SHA256

                                                                                                        b214a5cb8e702e4f4a6d6759361be5ca05453e2f2390ced6fc2ab414e1fb3313

                                                                                                        SHA512

                                                                                                        c75316d64d614b361823add1852c95e2aa676bc3e501a1562c4c67f30807d0b1bcdceead9f893895403ad65b9b680cd68e6142118bd247ef695f3bfd749767ce

                                                                                                        Download Submit

                                                                                                      • C:\Windows\SystemTemp\msedge_installer.log
                                                                                                        Filesize

                                                                                                        104KB

                                                                                                        MD5

                                                                                                        9cc01b6155b5f273a5fda5e10206d521

                                                                                                        SHA1

                                                                                                        c243b25866e6da72628a75cce8558841618cff68

                                                                                                        SHA256

                                                                                                        38f9fafd5d2b276b4dff4564c18259650d650bd08af32da8d34e24daa7d49d8b

                                                                                                        SHA512

                                                                                                        1fa825aee847d754ab662d598fc67a51b58b8834016a31d126053689495fe6317e5ef90dc6ac779f344799e9b97195a5d11e86fb3ed27c2a3743da3631e2f01b

                                                                                                        Download Submit

                                                                                                      • memory/404-437-0x0000020907700000-0x000002090772B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/404-438-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/544-421-0x00007FFFA14E0000-0x00007FFFA16E9000-memory.dmp

                                                                                                        Filesize

                                                                                                        2.0MB

                                                                                                        Download

                                                                                                      • memory/544-422-0x00007FFF9F7F0000-0x00007FFF9F8AD000-memory.dmp

                                                                                                        Filesize

                                                                                                        756KB

                                                                                                        Download

                                                                                                      • memory/616-428-0x000001EE6EE80000-0x000001EE6EEAB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/616-429-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/616-427-0x000001EE6EE50000-0x000001EE6EE75000-memory.dmp

                                                                                                        Filesize

                                                                                                        148KB

                                                                                                        Download

                                                                                                      • memory/656-445-0x00000259DC760000-0x00000259DC78B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/656-446-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/704-432-0x000002BB1D540000-0x000002BB1D56B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/704-433-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/844-449-0x0000015CDD290000-0x0000015CDD2BB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/844-450-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/996-441-0x0000015298690000-0x00000152986BB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/996-442-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1032-456-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1032-455-0x000002127F140000-0x000002127F16B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1104-458-0x0000025697A90000-0x0000025697ABB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1104-459-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1124-462-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1124-461-0x000002102B5B0000-0x000002102B5DB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1144-471-0x0000029A79760000-0x0000029A7978B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1144-472-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1168-475-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1168-474-0x000001C76F830000-0x000001C76F85B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1244-477-0x000002345BE90000-0x000002345BEBB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1244-478-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1272-480-0x0000019778AB0000-0x0000019778ADB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1272-481-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1300-486-0x000001A905B60000-0x000001A905B8B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1300-487-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1308-483-0x0000019947E70000-0x0000019947E9B000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1308-484-0x00007FFF61570000-0x00007FFF61580000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        Download

                                                                                                      • memory/1464-489-0x000001E4172D0000-0x000001E4172FB000-memory.dmp

                                                                                                        Filesize

                                                                                                        172KB

                                                                                                        Download

                                                                                                      • memory/1920-1-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/1920-5-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/1920-0-0x00000000738C1000-0x00000000738C2000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/1920-2-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/1920-4-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/1920-7-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/1920-6-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/1920-693-0x00000000738C0000-0x0000000073E71000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.7MB

                                                                                                        Download

                                                                                                      • memory/2716-383-0x000000001BB90000-0x000000001BBE6000-memory.dmp

                                                                                                        Filesize

                                                                                                        344KB

                                                                                                        Download

                                                                                                      • memory/2716-382-0x0000000000FC0000-0x000000000103E000-memory.dmp

                                                                                                        Filesize

                                                                                                        504KB

                                                                                                        Download

                                                                                                      • memory/3992-423-0x00000000008A0000-0x00000000008CA000-memory.dmp

                                                                                                        Filesize

                                                                                                        168KB

                                                                                                        Download

                                                                                                      • memory/3992-424-0x00000000061C0000-0x0000000006252000-memory.dmp

                                                                                                        Filesize

                                                                                                        584KB

                                                                                                        Download

                                                                                                      • memory/3996-414-0x0000000000E40000-0x0000000000E54000-memory.dmp

                                                                                                        Filesize

                                                                                                        80KB

                                                                                                        Download