Overview

overview

10

Static

static

deda52b25f...25.exe

windows7-x64

10

deda52b25f...25.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    206s
  • max time network
    229s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/11/2022, 17:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe
  • Size 1.8MB
  • Sample221130-wavrwabe86
  • SHA256 deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratblacknetnanocorenjratremcosbotclientdefaulthostevasionkeyloggerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • dontreachme3.ddns.net:3603

  • dontreachme1.ddns.net:3603

Mutex

  • 19a5c2b0-5593-40da-9945-6c6b53e85d75

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    dontreachme1.ddns.net

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-11-15T15:45:18.745530536Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    3603

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    19a5c2b0-5593-40da-9945-6c6b53e85d75

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    dontreachme3.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    false

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • njrat

Version

  • 0.7.3

Botnet

  • Client

C2

  • dontreachme3.ddns.net:3604

Mutex

  • EdgeBrowser.exe

Attributes
  • reg_key

    EdgeBrowser.exe

  • splitter

    123

Extracted

Family

  • blacknet

Version

  • v3.7.0 Public

Botnet

  • Bot

C2

  • https://furyx.de/panel

Mutex

  • BN[e5decf896675e5ecc7bbef8ebff8a786]

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    50651597687556f33b7fc75d90350b99

  • startup

    false

  • usb_spread

    true

aes.plain

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • dontreachme3.ddns.net:3605

  • dontreachme1.ddns.net:3605

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    explorer.exe

  • copy_folder

    explorer

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %SystemDrive%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    RuntimeBroker

  • keylog_path

    %AppData%

  • mouse_option

    true

  • mutex

    remcos_ekuntpjjaa

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    RuntimeBroker

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • Default

C2

  • dontreachme3.ddns.net:3601

  • dontreachme1.ddns.net:3601

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    EpicGames.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet
  • BlackNET payload 1 IoCs
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Turns off Windows Defender SpyNet reporting 2 TTPs
    evasion
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 11 IoCs
    evasiontrojan
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Async RAT payload 1 IoCs
    rat
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 21 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 10 IoCs
  • Windows security modification 2 TTPs 19 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 17 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 6 IoCs
    evasion
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe
    "C:\Users\Admin\AppData\Local\Temp\deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Local\Temp\tmpA6B0.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpA6B0.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Users\Admin\Documents\WD+UAC.exe
        "C:\Users\Admin\Documents\WD+UAC.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System policy modification
        PID:3608
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 920
          4⤵
          • Program crash
          PID:4612
      • C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe
        "C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 1644
          4⤵
          • Program crash
          PID:5788
      • C:\Users\Admin\Documents\EasyAASM.exe
        "C:\Users\Admin\Documents\EasyAASM.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Checks computer location settings
        PID:3296
        • C:\Windows\SysWOW64\reagentc.exe
          reagentc.exe /disable
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:6008
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:6080
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:6092
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:6112
        • C:\Users\Admin\AppData\Roaming\realtekaudio.exe
          "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:6860
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5484
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
            5⤵
              PID:3560
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
              5⤵
                PID:7032
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\realtekaudio.exe" -Force
                5⤵
                  PID:5432
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout 1
                  5⤵
                    PID:2348
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      6⤵
                      • Delays execution with timeout.exe
                      PID:1460
                  • C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                    "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:3800
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 2360
                    5⤵
                    • Program crash
                    PID:444
                • C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                  C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                  4⤵
                  • Modifies WinLogon for persistence
                  • Windows security bypass
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Drops startup file
                  • Windows security modification
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6888
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
                    5⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5844
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
                    5⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2544
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
                    5⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6268
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\realtekaudio.exe" -Force
                    5⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4844
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c timeout 1
                    5⤵
                      PID:5672
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        6⤵
                        • Delays execution with timeout.exe
                        PID:2348
                    • C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                      "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:2812
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 2240
                      5⤵
                      • Program crash
                      PID:5764
                • C:\Users\Admin\Documents\Firefoxinstaller.exe
                  "C:\Users\Admin\Documents\Firefoxinstaller.exe"
                  3⤵
                  • Modifies WinLogon for persistence
                  • Windows security bypass
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Drops startup file
                  • Windows security modification
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4880
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3192
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4632
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:396
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\Firefoxinstaller.exe" -Force
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3224
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c timeout 1
                    4⤵
                      PID:5776
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        5⤵
                        • Delays execution with timeout.exe
                        PID:5560
                    • C:\Users\Admin\Documents\Firefoxinstaller.exe
                      "C:\Users\Admin\Documents\Firefoxinstaller.exe"
                      4⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      PID:6252
                      • C:\Users\Admin\Documents\Firefoxinstaller.exe
                        "C:\Users\Admin\Documents\Firefoxinstaller.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:6840
                  • C:\Users\Admin\Documents\NortonInstaller.exe
                    "C:\Users\Admin\Documents\NortonInstaller.exe"
                    3⤵
                    • Modifies WinLogon for persistence
                    • Windows security bypass
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Drops startup file
                    • Windows security modification
                    • Adds Run key to start application
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1996
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NortonInstaller.exe" -Force
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4996
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NortonInstaller.exe" -Force
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4264
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NortonInstaller.exe" -Force
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2084
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\NortonInstaller.exe" -Force
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1064
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c timeout 1
                      4⤵
                        PID:5764
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          5⤵
                          • Delays execution with timeout.exe
                          PID:5572
                      • C:\Users\Admin\Documents\NortonInstaller.exe
                        "C:\Users\Admin\Documents\NortonInstaller.exe"
                        4⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6272
                        • C:\Windows\SysWOW64\schtasks.exe
                          "schtasks.exe" /create /f /tn "UPNP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3687.tmp"
                          5⤵
                          • Creates scheduled task(s)
                          PID:3484
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 2356
                        4⤵
                        • Program crash
                        PID:6564
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 2356
                        4⤵
                        • Program crash
                        PID:6772
                    • C:\Users\Admin\Documents\WinExplorer.exe
                      "C:\Users\Admin\Documents\WinExplorer.exe"
                      3⤵
                      • Modifies WinLogon for persistence
                      • Windows security bypass
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Drops startup file
                      • Windows security modification
                      • Adds Run key to start application
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1544
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4684
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3580
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1252
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\WinExplorer.exe" -Force
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4364
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c timeout 1
                        4⤵
                          PID:5740
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            5⤵
                            • Delays execution with timeout.exe
                            PID:5552
                        • C:\Users\Admin\Documents\WinExplorer.exe
                          "C:\Users\Admin\Documents\WinExplorer.exe"
                          4⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6260
                          • C:\Users\Admin\Documents\WindowsExplorer.exe
                            "C:\Users\Admin\Documents\WindowsExplorer.exe"
                            5⤵
                            • Modifies WinLogon for persistence
                            • Adds policy Run key to start application
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Adds Run key to start application
                            • Modifies WinLogon
                            PID:1476
                            • C:\Windows\SysWOW64\cmd.exe
                              /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                              6⤵
                                PID:4476
                                • C:\Windows\SysWOW64\reg.exe
                                  C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                  7⤵
                                  • UAC bypass
                                  • Modifies registry key
                                  PID:4276
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
                                6⤵
                                  PID:6672
                                  • C:\Windows\SysWOW64\PING.EXE
                                    PING 127.0.0.1 -n 2
                                    7⤵
                                    • Runs ping.exe
                                    PID:6560
                                  • C:\explorer\explorer.exe
                                    "C:\explorer\explorer.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:7344
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 2388
                              4⤵
                              • Program crash
                              PID:6576
                          • C:\Users\Admin\Documents\EdgeBrowser.exe
                            "C:\Users\Admin\Documents\EdgeBrowser.exe"
                            3⤵
                            • Modifies WinLogon for persistence
                            • Modifies Windows Defender Real-time Protection settings
                            • Windows security bypass
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Drops startup file
                            • Windows security modification
                            • Adds Run key to start application
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3048
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3328
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2676
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4660
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\EdgeBrowser.exe" -Force
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4444
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c timeout 1
                              4⤵
                                PID:5752
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  5⤵
                                  • Delays execution with timeout.exe
                                  PID:5712
                              • C:\Users\Admin\Documents\EdgeBrowser.exe
                                "C:\Users\Admin\Documents\EdgeBrowser.exe"
                                4⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                PID:6244
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /Delete /tn NYAN /F
                                  5⤵
                                    PID:6984
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /tn NYAN /tr "C:\Users\Admin\Documents\EdgeBrowser.exe" /sc minute /mo 1
                                    5⤵
                                    • Creates scheduled task(s)
                                    PID:7004
                                  • C:\Users\Admin\EdgeBrowser.exe
                                    "C:\Users\Admin\EdgeBrowser.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:2492
                            • C:\Users\Admin\AppData\Local\Temp\tmpA75D.tmp.exe
                              "C:\Users\Admin\AppData\Local\Temp\tmpA75D.tmp.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:3832
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3608 -ip 3608
                            1⤵
                              PID:4940
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4468 -ip 4468
                              1⤵
                                PID:5644
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1996 -ip 1996
                                1⤵
                                  PID:6508
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1544 -ip 1544
                                  1⤵
                                    PID:6516
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6888 -ip 6888
                                    1⤵
                                      PID:3132
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6860 -ip 6860
                                      1⤵
                                        PID:6480

                                      Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            EdgeBrowser.exe.log
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EdgeBrowser.exe.log
                                            • Size 1KB
                                            • SHA256 7b545eafedcb5dc2e9f12ec051d88c3f2995ab3864d03c56dd0ed1aeb59ff6dc
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Firefoxinstaller.exe.log
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Firefoxinstaller.exe.log
                                            • Size 1KB
                                            • SHA256 bef0fe04c67e31e8b09cef7f80eb8b4483c939d290bac4cee7717e9cb05ccfa8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            install.bat
                                            • Path C:\Users\Admin\AppData\Local\Temp\install.bat
                                            • Size 127B
                                            • SHA256 8ed98d8b82c482aaa79a8ea2f1aaea676c5641d69f2478ba7f241e990d5d99b1
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            tmp3687.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmp3687.tmp
                                            • Size 1KB
                                            • SHA256 735f05df747c5fee00b019083ce51cc52bc338382228e43441f1700a8dc3385b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            tmpA6B0.tmp.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpA6B0.tmp.exe
                                            • Size 1.3MB
                                            • SHA256 7c85333ea420f466a6d3113f5ded4c3cadc8ba4d9ae92fe2f53d475543c8c87b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tmpA6B0.tmp.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpA6B0.tmp.exe
                                            • Size 1.3MB
                                            • SHA256 7c85333ea420f466a6d3113f5ded4c3cadc8ba4d9ae92fe2f53d475543c8c87b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tmpA75D.tmp.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpA75D.tmp.exe
                                            • Size 479KB
                                            • SHA256 73b7fea4754e8be18812adc0ddd7b3c3c8c3797a889cc801cc94c7195027aa11
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tmpA75D.tmp.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpA75D.tmp.exe
                                            • Size 479KB
                                            • SHA256 73b7fea4754e8be18812adc0ddd7b3c3c8c3797a889cc801cc94c7195027aa11
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            realtekaudio.exe
                                            • Path C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                                            • Size 1.1MB
                                            • SHA256 f8cfedc4ecdfa6a3e14f46968b5a8e6797a448b0d30f12015cd721121470fcfd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            realtekaudio.exe
                                            • Path C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                                            • Size 1.1MB
                                            • SHA256 f8cfedc4ecdfa6a3e14f46968b5a8e6797a448b0d30f12015cd721121470fcfd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            realtekaudio.exe
                                            • Path C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                                            • Size 1.1MB
                                            • SHA256 f8cfedc4ecdfa6a3e14f46968b5a8e6797a448b0d30f12015cd721121470fcfd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            realtekaudio.exe
                                            • Path C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                                            • Size 1.1MB
                                            • SHA256 f8cfedc4ecdfa6a3e14f46968b5a8e6797a448b0d30f12015cd721121470fcfd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            realtekaudio.exe
                                            • Path C:\Users\Admin\AppData\Roaming\realtekaudio.exe
                                            • Size 1.1MB
                                            • SHA256 f8cfedc4ecdfa6a3e14f46968b5a8e6797a448b0d30f12015cd721121470fcfd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EasyAASM.exe
                                            • Path C:\Users\Admin\Documents\EasyAASM.exe
                                            • Size 315KB
                                            • SHA256 133a86c10b14d53d0807901d3cd477b0e1f62b9351707fe82ded7fe19c1f7689
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EasyAASM.exe
                                            • Path C:\Users\Admin\Documents\EasyAASM.exe
                                            • Size 315KB
                                            • SHA256 133a86c10b14d53d0807901d3cd477b0e1f62b9351707fe82ded7fe19c1f7689
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EdgeBrowser.exe
                                            • Path C:\Users\Admin\Documents\EdgeBrowser.exe
                                            • Size 1.3MB
                                            • SHA256 eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EdgeBrowser.exe
                                            • Path C:\Users\Admin\Documents\EdgeBrowser.exe
                                            • Size 1.3MB
                                            • SHA256 eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EdgeBrowser.exe
                                            • Path C:\Users\Admin\Documents\EdgeBrowser.exe
                                            • Size 1.3MB
                                            • SHA256 eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Firefoxinstaller.exe
                                            • Path C:\Users\Admin\Documents\Firefoxinstaller.exe
                                            • Size 1.5MB
                                            • SHA256 7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Firefoxinstaller.exe
                                            • Path C:\Users\Admin\Documents\Firefoxinstaller.exe
                                            • Size 1.5MB
                                            • SHA256 7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Firefoxinstaller.exe
                                            • Path C:\Users\Admin\Documents\Firefoxinstaller.exe
                                            • Size 1.5MB
                                            • SHA256 7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Firefoxinstaller.exe
                                            • Path C:\Users\Admin\Documents\Firefoxinstaller.exe
                                            • Size 1.5MB
                                            • SHA256 7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            MicrosoftCompatibility Download.exe
                                            • Path C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe
                                            • Size 29KB
                                            • SHA256 671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            MicrosoftCompatibility Download.exe
                                            • Path C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe
                                            • Size 29KB
                                            • SHA256 671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            NortonInstaller.exe
                                            • Path C:\Users\Admin\Documents\NortonInstaller.exe
                                            • Size 2.1MB
                                            • SHA256 26742bef88539fcb6beb9753293a4fef4044663cfcb0a799e989194fcdfd3456
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            NortonInstaller.exe
                                            • Path C:\Users\Admin\Documents\NortonInstaller.exe
                                            • Size 2.1MB
                                            • SHA256 26742bef88539fcb6beb9753293a4fef4044663cfcb0a799e989194fcdfd3456
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            NortonInstaller.exe
                                            • Path C:\Users\Admin\Documents\NortonInstaller.exe
                                            • Size 2.1MB
                                            • SHA256 26742bef88539fcb6beb9753293a4fef4044663cfcb0a799e989194fcdfd3456
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WD+UAC.exe
                                            • Path C:\Users\Admin\Documents\WD+UAC.exe
                                            • Size 97KB
                                            • SHA256 7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WD+UAC.exe
                                            • Path C:\Users\Admin\Documents\WD+UAC.exe
                                            • Size 97KB
                                            • SHA256 7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WinExplorer.exe
                                            • Path C:\Users\Admin\Documents\WinExplorer.exe
                                            • Size 1.0MB
                                            • SHA256 6c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WinExplorer.exe
                                            • Path C:\Users\Admin\Documents\WinExplorer.exe
                                            • Size 1.0MB
                                            • SHA256 6c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WinExplorer.exe
                                            • Path C:\Users\Admin\Documents\WinExplorer.exe
                                            • Size 1.0MB
                                            • SHA256 6c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WindowsExplorer.exe
                                            • Path C:\Users\Admin\Documents\WindowsExplorer.exe
                                            • Size 92KB
                                            • SHA256 862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            WindowsExplorer.exe
                                            • Path C:\Users\Admin\Documents\WindowsExplorer.exe
                                            • Size 92KB
                                            • SHA256 862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EdgeBrowser.exe
                                            • Path C:\Users\Admin\EdgeBrowser.exe
                                            • Size 1.3MB
                                            • SHA256 eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            EdgeBrowser.exe
                                            • Path C:\Users\Admin\EdgeBrowser.exe
                                            • Size 1.3MB
                                            • SHA256 eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            explorer.exe
                                            • Path C:\explorer\explorer.exe
                                            • Size 92KB
                                            • SHA256 862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            explorer.exe
                                            • Path C:\explorer\explorer.exe
                                            • Size 92KB
                                            • SHA256 862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            memory/1544-166-0x0000000000620000-0x000000000072C000-memory.dmp
                                            Download

                                            memory/1996-162-0x0000000000220000-0x0000000000444000-memory.dmp
                                            Download

                                            memory/2084-210-0x00000000065D0000-0x00000000065EE000-memory.dmp
                                            Download

                                            memory/2084-196-0x0000000005750000-0x00000000057B6000-memory.dmp
                                            Download

                                            memory/2196-136-0x0000000000560000-0x00000000006A8000-memory.dmp
                                            Download

                                            memory/2196-149-0x00007FFD9A4D0000-0x00007FFD9AF91000-memory.dmp
                                            Download

                                            memory/2196-173-0x00007FFD9A4D0000-0x00007FFD9AF91000-memory.dmp
                                            Download

                                            memory/2812-253-0x0000000000400000-0x0000000000412000-memory.dmp
                                            Download

                                            memory/3048-172-0x00000000000C0000-0x0000000000206000-memory.dmp
                                            Download

                                            memory/3296-169-0x0000000005490000-0x0000000005522000-memory.dmp
                                            Download

                                            memory/3296-176-0x00000000052F0000-0x00000000052FA000-memory.dmp
                                            Download

                                            memory/3296-182-0x0000000005530000-0x0000000005586000-memory.dmp
                                            Download

                                            memory/3296-157-0x0000000000A50000-0x0000000000AA6000-memory.dmp
                                            Download

                                            memory/3608-156-0x0000000000D50000-0x0000000000D72000-memory.dmp
                                            Download

                                            memory/3608-167-0x000000000A340000-0x000000000A8E4000-memory.dmp
                                            Download

                                            memory/3832-151-0x0000000000400000-0x00000000004AC000-memory.dmp
                                            Download

                                            memory/3832-174-0x0000000000400000-0x00000000004AC000-memory.dmp
                                            Download

                                            memory/4244-132-0x00007FFD9B120000-0x00007FFD9BB56000-memory.dmp
                                            Download

                                            memory/4364-195-0x0000000004F50000-0x0000000004F72000-memory.dmp
                                            Download

                                            memory/4364-193-0x0000000002690000-0x00000000026C6000-memory.dmp
                                            Download

                                            memory/4468-154-0x0000000000A90000-0x0000000000A9E000-memory.dmp
                                            Download

                                            memory/4660-194-0x00000000052C0000-0x00000000058E8000-memory.dmp
                                            Download

                                            memory/4880-155-0x0000000000190000-0x0000000000320000-memory.dmp
                                            Download

                                            memory/4880-158-0x0000000004B30000-0x0000000004BCC000-memory.dmp
                                            Download

                                            memory/4996-197-0x0000000005650000-0x00000000056B6000-memory.dmp
                                            Download

                                            memory/6244-215-0x0000000000400000-0x000000000041A000-memory.dmp
                                            Download

                                            memory/6252-217-0x0000000000400000-0x0000000000426000-memory.dmp
                                            Download

                                            memory/6260-216-0x0000000000400000-0x0000000000412000-memory.dmp
                                            Download

                                            memory/6272-218-0x0000000000400000-0x000000000043A000-memory.dmp
                                            Download

                                            memory/6840-226-0x0000000000400000-0x000000000041E000-memory.dmp
                                            Download

                                            memory/6888-235-0x0000000000E20000-0x0000000000F34000-memory.dmp
                                            Download