Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    896s
  • max time network
    894s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    08/02/2025, 11:33

General

  • Target

    nkth.exe

  • Size

    55KB

  • MD5

    33644523cb6a6c01bbf2dd5c3a97aafc

  • SHA1

    7fd0d35a09a32693d30ffdb49ecd69c1229d2a20

  • SHA256

    e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45

  • SHA512

    43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b

  • SSDEEP

    1536:5EOADn6cpNPmSpVcDGiwsNMDdXExI3pmsm:bADn6cPzLcDGiwsNMDdXExI3pm

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

3skr.uncofig.com:9999

Mutex

45383d8d8d15dbb304a561fd6c64bb12

Attributes
  • reg_key

    45383d8d8d15dbb304a561fd6c64bb12

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 13 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • System policy modification 1 TTPs 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\nkth.exe
    "C:\Users\Admin\AppData\Local\Temp\nkth.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\727686fa90af4d84a106bea1f564c96a.EXE
      "C:\Users\Admin\AppData\Local\Temp\727686fa90af4d84a106bea1f564c96a.EXE"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:412
      • C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe
        "C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:1092
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Mason" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\Mason.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2136
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF4ED.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:2900
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkth.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkth.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4780
    • C:\Users\Admin\AppData\Local\Temp\nkth.exe
      "C:\Users\Admin\AppData\Local\Temp\nkth.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4192
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0Q3MjU2NDgtRTU0NC00NDU3LUIyREEtMEIyNEZDNzcxMzk2fSIgdXNlcmlkPSJ7MjZFMEFENUYtMTE1My00MkY2LThDMDQtOTRBRUM4QjZBOEMzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7REMxMkJBQ0ItMUUyQy00QTEzLUJFMEMtNjNCRkNGNkY2NkQ2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ5MjgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNzQzMjM4OTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTM4NTQwMzIyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4896
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3340
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff676f7a818,0x7ff676f7a824,0x7ff676f7a830
        3⤵
        • Executes dropped EXE
        PID:3016
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff676f7a818,0x7ff676f7a824,0x7ff676f7a830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2640
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4908
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff692e9a818,0x7ff692e9a824,0x7ff692e9a830
          4⤵
          • Executes dropped EXE
          PID:4564
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff692e9a818,0x7ff692e9a824,0x7ff692e9a830
          4⤵
          • Executes dropped EXE
          PID:4400
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0xc8,0x230,0x7ff692e9a818,0x7ff692e9a824,0x7ff692e9a830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2532
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:3152
    • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
      "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4644
    • C:\Windows\system32\wwahost.exe
      "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1984
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0Q3MjU2NDgtRTU0NC00NDU3LUIyREEtMEIyNEZDNzcxMzk2fSIgdXNlcmlkPSJ7MjZFMEFENUYtMTE1My00MkY2LThDMDQtOTRBRUM4QjZBOEMzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntBNUM3M0MxMy1DOUMzLTQzNkEtQkZBNC04OEEyNTA0QkYyRjZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGNvaG9ydD0icnJmQDAuNDMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7NTY2MTJDRDMtMERCMi00OUU0LUFFRTEtNUFEMDNDNTYyRDlBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzQyNjIwMzcxMTUwMDAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNjE2NjU2MDEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE2MTY2NTYwMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjI5MTA0MDc0MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NjE5NTMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW52JTJmVSUyYk9laDlHdTN0RXJqYVIzRncwR0xVYWNEZENnb2xhTFVicWVZelFWSEIwQVF0TFd4UU1JWVJEVmJRd2ZtZlRYbHRPUHl3MktHZURXVDFVdW56QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyOTEwNDA3NDIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NjE5NTMyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW52JTJmVSUyYk9laDlHdTN0RXJqYVIzRncwR0xVYWNEZENnb2xhTFVicWVZelFWSEIwQVF0TFd4UU1JWVJEVmJRd2ZtZlRYbHRPUHl3MktHZURXVDFVdW56QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NzE4MDIxNiIgdG90YWw9IjE3NzE4MDIxNiIgZG93bmxvYWRfdGltZV9tcz0iMTA2NzM0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyOTExOTY4ODciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMwNDYzNDk5OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjgzMDg4NDk5NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjExODgiIGRvd25sb2FkX3RpbWVfbXM9IjExMjk1MyIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI1MjYyNSIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMSIgcj0iMSIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0ie0IzQTZEQjc2LUYxMEMtNDU5MS1CRENELTExNkJCMDE4MTE0OH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjYwOCIgY29ob3J0PSJycmZAMC42OCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9InsxRjU2RUMwRC1EQTFGLTQ4NzEtQTdGNy0zMDlEQUE2QkQ1QkV9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5100

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{062AD0A6-0DB7-425E-BFC1-2A71C7093533}\EDGEMITMP_2A1BD.tmp\setup.exe

      Filesize

      6.6MB

      MD5

      b4c8ad75087b8634d4f04dc6f92da9aa

      SHA1

      7efaa2472521c79d58c4ef18a258cc573704fb5d

      SHA256

      522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

      SHA512

      5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

      Filesize

      3.7MB

      MD5

      3646786aea064c0845f5bb1b8e976985

      SHA1

      a31ba2d2192898d4c0a01511395bdf87b0e53873

      SHA256

      a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

      SHA512

      145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

    • C:\Program Files\msedge_installer.log

      Filesize

      72KB

      MD5

      58de91ab54fb83744e097f3a076e9eba

      SHA1

      826ee64a78f2c51a3415ff740effd2ddf49bfb90

      SHA256

      93d4d27c5ff0f7da3af23bdf941760af3e935cd766e65905191dbd5f11491802

      SHA512

      79e8d3461ea0f26bbfcc87e0121360e291adfbc9c4d3034effb89792b6eddd682c0874d5413ba7ff74e07c035829adb3d52ecbd23e0a18fd04d8975079e4209b

    • C:\Program Files\msedge_installer.log

      Filesize

      100KB

      MD5

      c7994f792c8354b6a82bb305e3c73590

      SHA1

      8076f2967cb57dab7ccf7766b518e32d067430af

      SHA256

      70a63c50036aa8e4d9b7efce8a5b733cd4c72a14debed6d2a1e9373ccaaaff57

      SHA512

      da3dcd678d214f0d2cec00776ee8290e676f59bcc7cc369da5d9648adf765faa402a58b6b879c6420b85386465e5f8fa56b45271291f9508d525a510bf672991

    • C:\Program Files\msedge_installer.log

      Filesize

      102KB

      MD5

      5701bc208a13a11cf67f139000ba7a31

      SHA1

      b33fc27bfe8f1ba110f268609023fdeb9f7991c8

      SHA256

      7847e490f26be5a470749f136377de54a449cecb1b09edeff82dbc85e448b0d6

      SHA512

      ae8c2b7b73e4584bf131b2df2929eb1ab65a1134362df778c6e499bf5f1846288cbae684e5b66cf41243ef4820cabf0f780c025b566fe2bca9740d21a4ddbcaf

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

      Filesize

      503KB

      MD5

      919c6059c811ab8bd8903e33ce2bd787

      SHA1

      668a7b31bef7dcd65bacfb014c72681e8fc72d08

      SHA256

      001a5a1cb1b11600c67658f997f8169a9a34f0bf3d8d2284c6a1a2c2c9955d51

      SHA512

      1f4e3b5cadbbcbb84274fb332f8cddca7a2a501fcf497c50abfab977f4ed5923fb73e54308761f3fb1533d87bbe9e98e67bc17c20430f6f3a5fe58c470545afa

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\nkth.exe.log

      Filesize

      319B

      MD5

      da4fafeffe21b7cb3a8c170ca7911976

      SHA1

      50ef77e2451ab60f93f4db88325b897d215be5ad

      SHA256

      7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

      SHA512

      0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

    • C:\Users\Admin\AppData\Local\Temp\727686fa90af4d84a106bea1f564c96a.EXE

      Filesize

      241KB

      MD5

      8964489afcdf25c4eef3aea0e0c9a872

      SHA1

      656485b929fd67c26f733ba6e85525d76c8f9791

      SHA256

      6b4840400cf2f697ce98a66af37497447278ffef8dcac35182726154146ea066

      SHA512

      3ff73c9c910e1f30c9235501864e79d6ac4bc8fafbb62191edca0b4f5ad5c6a46efce9065c2cf169775b83954085d79d2cb45d6f4be8fdbb85a6163f98fecfab

    • C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe

      Filesize

      150KB

      MD5

      e8a16450f1f658e2a216317eeab1ea49

      SHA1

      19b26d056d24b1e00933a104a8e320ba52c9c1eb

      SHA256

      6c0ffa7412a2aecdd253d12481460a4dd3ee02d912c3ee4d2124274e12add8a5

      SHA512

      93f952c4891eeb62a90b969973dcd5e5ce85b6d020b96f2520a5fcd47b21a4c6ccf9512d2c935c4dc3557b184a32d8b0623b342a1344b48fba24b6944749db98

    • C:\Users\Admin\AppData\Local\Temp\tmpF4ED.tmp.bat

      Filesize

      184B

      MD5

      7ab0c710dda1bc3c630611af5c82dd0c

      SHA1

      04f8168bdf5fbbe7927a15d42be4ebc30af819b3

      SHA256

      19ac71a0f816e143bc304ef59671e0bd1321e77130603d7278e900fa4a9caa91

      SHA512

      ba721cce8048e6cde42b7c4c408bb4a31ab1a231d288aaf4d27e1dd6ee195db21337c7d1e5b7af3a3808c8779bd79012d1b315b4a8e60d76b3e06cbd4d38e935

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkth.exe

      Filesize

      55KB

      MD5

      33644523cb6a6c01bbf2dd5c3a97aafc

      SHA1

      7fd0d35a09a32693d30ffdb49ecd69c1229d2a20

      SHA256

      e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45

      SHA512

      43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b

    • memory/412-437-0x0000000000F80000-0x0000000000FC2000-memory.dmp

      Filesize

      264KB

    • memory/412-438-0x0000000001980000-0x0000000001996000-memory.dmp

      Filesize

      88KB

    • memory/1040-7-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1040-3-0x0000000073AA2000-0x0000000073AA3000-memory.dmp

      Filesize

      4KB

    • memory/1040-471-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1040-1-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1040-2-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1040-0-0x0000000073AA2000-0x0000000073AA3000-memory.dmp

      Filesize

      4KB

    • memory/1040-6-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1040-5-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1040-4-0x0000000073AA0000-0x0000000074051000-memory.dmp

      Filesize

      5.7MB

    • memory/1092-453-0x00000000000F0000-0x000000000011A000-memory.dmp

      Filesize

      168KB

    • memory/1092-458-0x0000000004EF0000-0x0000000005494000-memory.dmp

      Filesize

      5.6MB

    • memory/1092-459-0x0000000005740000-0x00000000057D2000-memory.dmp

      Filesize

      584KB

    • memory/1092-460-0x0000000005A80000-0x0000000005A8A000-memory.dmp

      Filesize

      40KB

    • memory/4644-67-0x0000016540D80000-0x0000016540D8A000-memory.dmp

      Filesize

      40KB

    • memory/4644-66-0x0000016526870000-0x000001652687E000-memory.dmp

      Filesize

      56KB

    • memory/4644-69-0x0000016542030000-0x0000016542279000-memory.dmp

      Filesize

      2.3MB

    • memory/4644-68-0x0000016540DB0000-0x0000016540DB8000-memory.dmp

      Filesize

      32KB