Overview

overview

8

Static

static

3

2026-07-02...op.exe

windows10-2004-x64

7

2026-07-02...op.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/07/2026, 22:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_587e31820e9dcf7b0746d3173d5adb40_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260702-2rygzsf14x
  • SHA256 14387ba7eee28e430dc2eff420b5337987675bd72f8cf00632187d3468534a0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 52 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_587e31820e9dcf7b0746d3173d5adb40_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_587e31820e9dcf7b0746d3173d5adb40_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2688
    • C:\Users\Admin\AppData\Local\Temp\motkqg.exe
      "C:\Users\Admin\AppData\Local\Temp\motkqg.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Users\Admin\AppData\Local\Temp\motkqg.exe
        "C:\Users\Admin\AppData\Local\Temp\motkqg.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Users\Admin\AppData\Roaming\Download\942560.exe
          "C:\Users\Admin\AppData\Roaming\Download\942560.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2268
          • C:\Users\Admin\AppData\Roaming\Download\942560.exe
            "C:\Users\Admin\AppData\Roaming\Download\942560.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3560
        • C:\Users\Admin\AppData\Roaming\Download\819632.exe
          "C:\Users\Admin\AppData\Roaming\Download\819632.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2932
          • C:\Users\Admin\AppData\Roaming\Download\819632.exe
            "C:\Users\Admin\AppData\Roaming\Download\819632.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5044
        • C:\Users\Admin\AppData\Roaming\Download\831998.exe
          "C:\Users\Admin\AppData\Roaming\Download\831998.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Users\Admin\AppData\Roaming\Download\831998.exe
            "C:\Users\Admin\AppData\Roaming\Download\831998.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2360
        • C:\Users\Admin\AppData\Roaming\Download\856054.exe
          "C:\Users\Admin\AppData\Roaming\Download\856054.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Users\Admin\AppData\Roaming\Download\856054.exe
            "C:\Users\Admin\AppData\Roaming\Download\856054.exe"
            5⤵
            • Executes dropped EXE
            PID:1840
        • C:\Users\Admin\AppData\Roaming\Download\067405.exe
          "C:\Users\Admin\AppData\Roaming\Download\067405.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Users\Admin\AppData\Roaming\Download\067405.exe
            "C:\Users\Admin\AppData\Roaming\Download\067405.exe"
            5⤵
            • Executes dropped EXE
            PID:4248
        • C:\Users\Admin\AppData\Roaming\Download\244292.exe
          "C:\Users\Admin\AppData\Roaming\Download\244292.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3004
          • C:\Users\Admin\AppData\Roaming\Download\244292.exe
            "C:\Users\Admin\AppData\Roaming\Download\244292.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5136
        • C:\Users\Admin\AppData\Roaming\Download\887195.exe
          "C:\Users\Admin\AppData\Roaming\Download\887195.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5400
          • C:\Users\Admin\AppData\Roaming\Download\887195.exe
            "C:\Users\Admin\AppData\Roaming\Download\887195.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5460
        • C:\Users\Admin\AppData\Roaming\Download\044113.exe
          "C:\Users\Admin\AppData\Roaming\Download\044113.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5796
          • C:\Users\Admin\AppData\Roaming\Download\044113.exe
            "C:\Users\Admin\AppData\Roaming\Download\044113.exe"
            5⤵
            • Executes dropped EXE
            PID:5848
        • C:\Users\Admin\AppData\Roaming\Download\396279.exe
          "C:\Users\Admin\AppData\Roaming\Download\396279.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5940
          • C:\Users\Admin\AppData\Roaming\Download\396279.exe
            "C:\Users\Admin\AppData\Roaming\Download\396279.exe"
            5⤵
            • Executes dropped EXE
            PID:5992
        • C:\Users\Admin\AppData\Roaming\Download\270729.exe
          "C:\Users\Admin\AppData\Roaming\Download\270729.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6092
          • C:\Users\Admin\AppData\Roaming\Download\270729.exe
            "C:\Users\Admin\AppData\Roaming\Download\270729.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4248
        • C:\Users\Admin\AppData\Roaming\Download\212085.exe
          "C:\Users\Admin\AppData\Roaming\Download\212085.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4264
          • C:\Users\Admin\AppData\Roaming\Download\212085.exe
            "C:\Users\Admin\AppData\Roaming\Download\212085.exe"
            5⤵
            • Executes dropped EXE
            PID:5392
        • C:\Users\Admin\AppData\Roaming\Download\444141.exe
          "C:\Users\Admin\AppData\Roaming\Download\444141.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5440
          • C:\Users\Admin\AppData\Roaming\Download\444141.exe
            "C:\Users\Admin\AppData\Roaming\Download\444141.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5460
        • C:\Users\Admin\AppData\Roaming\Download\467419.exe
          "C:\Users\Admin\AppData\Roaming\Download\467419.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5732
          • C:\Users\Admin\AppData\Roaming\Download\467419.exe
            "C:\Users\Admin\AppData\Roaming\Download\467419.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2028
        • C:\Users\Admin\AppData\Roaming\Download\509575.exe
          "C:\Users\Admin\AppData\Roaming\Download\509575.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5764
          • C:\Users\Admin\AppData\Roaming\Download\509575.exe
            "C:\Users\Admin\AppData\Roaming\Download\509575.exe"
            5⤵
            • Executes dropped EXE
            PID:5852
        • C:\Users\Admin\AppData\Roaming\Download\448294.exe
          "C:\Users\Admin\AppData\Roaming\Download\448294.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5884
          • C:\Users\Admin\AppData\Roaming\Download\448294.exe
            "C:\Users\Admin\AppData\Roaming\Download\448294.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5928
        • C:\Users\Admin\AppData\Roaming\Download\480550.exe
          "C:\Users\Admin\AppData\Roaming\Download\480550.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6024
          • C:\Users\Admin\AppData\Roaming\Download\480550.exe
            "C:\Users\Admin\AppData\Roaming\Download\480550.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6072
        • C:\Users\Admin\AppData\Roaming\Download\544521.exe
          "C:\Users\Admin\AppData\Roaming\Download\544521.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6132
          • C:\Users\Admin\AppData\Roaming\Download\544521.exe
            "C:\Users\Admin\AppData\Roaming\Download\544521.exe"
            5⤵
            • Executes dropped EXE
            PID:4212
        • C:\Users\Admin\AppData\Roaming\Download\435972.exe
          "C:\Users\Admin\AppData\Roaming\Download\435972.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4004
          • C:\Users\Admin\AppData\Roaming\Download\435972.exe
            "C:\Users\Admin\AppData\Roaming\Download\435972.exe"
            5⤵
            • Executes dropped EXE
            PID:5336
        • C:\Users\Admin\AppData\Roaming\Download\564443.exe
          "C:\Users\Admin\AppData\Roaming\Download\564443.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3400
          • C:\Users\Admin\AppData\Roaming\Download\564443.exe
            "C:\Users\Admin\AppData\Roaming\Download\564443.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5296
        • C:\Users\Admin\AppData\Roaming\Download\599409.exe
          "C:\Users\Admin\AppData\Roaming\Download\599409.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5408
          • C:\Users\Admin\AppData\Roaming\Download\599409.exe
            "C:\Users\Admin\AppData\Roaming\Download\599409.exe"
            5⤵
            • Executes dropped EXE
            PID:5420
        • C:\Users\Admin\AppData\Roaming\Download\590930.exe
          "C:\Users\Admin\AppData\Roaming\Download\590930.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2120
          • C:\Users\Admin\AppData\Roaming\Download\590930.exe
            "C:\Users\Admin\AppData\Roaming\Download\590930.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5032
        • C:\Users\Admin\AppData\Roaming\Download\577584.exe
          "C:\Users\Admin\AppData\Roaming\Download\577584.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4108
          • C:\Users\Admin\AppData\Roaming\Download\577584.exe
            "C:\Users\Admin\AppData\Roaming\Download\577584.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5092
        • C:\Users\Admin\AppData\Roaming\Download\590640.exe
          "C:\Users\Admin\AppData\Roaming\Download\590640.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5776
          • C:\Users\Admin\AppData\Roaming\Download\590640.exe
            "C:\Users\Admin\AppData\Roaming\Download\590640.exe"
            5⤵
            • Executes dropped EXE
            PID:3024
        • C:\Users\Admin\AppData\Roaming\Download\534906.exe
          "C:\Users\Admin\AppData\Roaming\Download\534906.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5956
          • C:\Users\Admin\AppData\Roaming\Download\534906.exe
            "C:\Users\Admin\AppData\Roaming\Download\534906.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4580
        • C:\Users\Admin\AppData\Roaming\Download\653358.exe
          "C:\Users\Admin\AppData\Roaming\Download\653358.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5168
          • C:\Users\Admin\AppData\Roaming\Download\653358.exe
            "C:\Users\Admin\AppData\Roaming\Download\653358.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6084
        • C:\Users\Admin\AppData\Roaming\Download\676414.exe
          "C:\Users\Admin\AppData\Roaming\Download\676414.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1548
          • C:\Users\Admin\AppData\Roaming\Download\676414.exe
            "C:\Users\Admin\AppData\Roaming\Download\676414.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4528
        • C:\Users\Admin\AppData\Roaming\Download\587964.exe
          "C:\Users\Admin\AppData\Roaming\Download\587964.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2032
          • C:\Users\Admin\AppData\Roaming\Download\587964.exe
            "C:\Users\Admin\AppData\Roaming\Download\587964.exe"
            5⤵
            • Executes dropped EXE
            PID:5444
        • C:\Users\Admin\AppData\Roaming\Download\809020.exe
          "C:\Users\Admin\AppData\Roaming\Download\809020.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2520
          • C:\Users\Admin\AppData\Roaming\Download\809020.exe
            "C:\Users\Admin\AppData\Roaming\Download\809020.exe"
            5⤵
            • Executes dropped EXE
            PID:5508
        • C:\Users\Admin\AppData\Roaming\Download\609655.exe
          "C:\Users\Admin\AppData\Roaming\Download\609655.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5672
          • C:\Users\Admin\AppData\Roaming\Download\609655.exe
            "C:\Users\Admin\AppData\Roaming\Download\609655.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1696
        • C:\Users\Admin\AppData\Roaming\Download\621920.exe
          "C:\Users\Admin\AppData\Roaming\Download\621920.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1120
          • C:\Users\Admin\AppData\Roaming\Download\621920.exe
            "C:\Users\Admin\AppData\Roaming\Download\621920.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2404
        • C:\Users\Admin\AppData\Roaming\Download\644006.exe
          "C:\Users\Admin\AppData\Roaming\Download\644006.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5804
          • C:\Users\Admin\AppData\Roaming\Download\644006.exe
            "C:\Users\Admin\AppData\Roaming\Download\644006.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5836
        • C:\Users\Admin\AppData\Roaming\Download\886362.exe
          "C:\Users\Admin\AppData\Roaming\Download\886362.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5928
          • C:\Users\Admin\AppData\Roaming\Download\886362.exe
            "C:\Users\Admin\AppData\Roaming\Download\886362.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2352
        • C:\Users\Admin\AppData\Roaming\Download\666899.exe
          "C:\Users\Admin\AppData\Roaming\Download\666899.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:5132
          • C:\Users\Admin\AppData\Roaming\Download\666899.exe
            "C:\Users\Admin\AppData\Roaming\Download\666899.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3504
        • C:\Users\Admin\AppData\Roaming\Download\444423.exe
          "C:\Users\Admin\AppData\Roaming\Download\444423.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5292
          • C:\Users\Admin\AppData\Roaming\Download\444423.exe
            "C:\Users\Admin\AppData\Roaming\Download\444423.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5384
        • C:\Users\Admin\AppData\Roaming\Download\686589.exe
          "C:\Users\Admin\AppData\Roaming\Download\686589.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3896
          • C:\Users\Admin\AppData\Roaming\Download\686589.exe
            "C:\Users\Admin\AppData\Roaming\Download\686589.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1960
        • C:\Users\Admin\AppData\Roaming\Download\973386.exe
          "C:\Users\Admin\AppData\Roaming\Download\973386.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:4452
          • C:\Users\Admin\AppData\Roaming\Download\973386.exe
            "C:\Users\Admin\AppData\Roaming\Download\973386.exe"
            5⤵
              PID:2676
          • C:\Users\Admin\AppData\Roaming\Download\996642.exe
            "C:\Users\Admin\AppData\Roaming\Download\996642.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5208
            • C:\Users\Admin\AppData\Roaming\Download\996642.exe
              "C:\Users\Admin\AppData\Roaming\Download\996642.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3720
          • C:\Users\Admin\AppData\Roaming\Download\975277.exe
            "C:\Users\Admin\AppData\Roaming\Download\975277.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:5636
            • C:\Users\Admin\AppData\Roaming\Download\975277.exe
              "C:\Users\Admin\AppData\Roaming\Download\975277.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2284
          • C:\Users\Admin\AppData\Roaming\Download\918354.exe
            "C:\Users\Admin\AppData\Roaming\Download\918354.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:5068
            • C:\Users\Admin\AppData\Roaming\Download\918354.exe
              "C:\Users\Admin\AppData\Roaming\Download\918354.exe"
              5⤵
                PID:3716
            • C:\Users\Admin\AppData\Roaming\Download\796989.exe
              "C:\Users\Admin\AppData\Roaming\Download\796989.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5792
              • C:\Users\Admin\AppData\Roaming\Download\796989.exe
                "C:\Users\Admin\AppData\Roaming\Download\796989.exe"
                5⤵
                  PID:5820
              • C:\Users\Admin\AppData\Roaming\Download\818255.exe
                "C:\Users\Admin\AppData\Roaming\Download\818255.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:5936
                • C:\Users\Admin\AppData\Roaming\Download\818255.exe
                  "C:\Users\Admin\AppData\Roaming\Download\818255.exe"
                  5⤵
                    PID:5964
                • C:\Users\Admin\AppData\Roaming\Download\050311.exe
                  "C:\Users\Admin\AppData\Roaming\Download\050311.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:872
                  • C:\Users\Admin\AppData\Roaming\Download\050311.exe
                    "C:\Users\Admin\AppData\Roaming\Download\050311.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2276
                • C:\Users\Admin\AppData\Roaming\Download\085676.exe
                  "C:\Users\Admin\AppData\Roaming\Download\085676.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:2224
                  • C:\Users\Admin\AppData\Roaming\Download\085676.exe
                    "C:\Users\Admin\AppData\Roaming\Download\085676.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:708
                • C:\Users\Admin\AppData\Roaming\Download\721496.exe
                  "C:\Users\Admin\AppData\Roaming\Download\721496.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:1712
                  • C:\Users\Admin\AppData\Roaming\Download\721496.exe
                    "C:\Users\Admin\AppData\Roaming\Download\721496.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2176
                • C:\Users\Admin\AppData\Roaming\Download\108283.exe
                  "C:\Users\Admin\AppData\Roaming\Download\108283.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:4656
                  • C:\Users\Admin\AppData\Roaming\Download\108283.exe
                    "C:\Users\Admin\AppData\Roaming\Download\108283.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5296
                • C:\Users\Admin\AppData\Roaming\Download\986818.exe
                  "C:\Users\Admin\AppData\Roaming\Download\986818.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5488
                  • C:\Users\Admin\AppData\Roaming\Download\986818.exe
                    "C:\Users\Admin\AppData\Roaming\Download\986818.exe"
                    5⤵
                      PID:5272
                  • C:\Users\Admin\AppData\Roaming\Download\273515.exe
                    "C:\Users\Admin\AppData\Roaming\Download\273515.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:5600
                    • C:\Users\Admin\AppData\Roaming\Download\273515.exe
                      "C:\Users\Admin\AppData\Roaming\Download\273515.exe"
                      5⤵
                        PID:5596
                    • C:\Users\Admin\AppData\Roaming\Download\253141.exe
                      "C:\Users\Admin\AppData\Roaming\Download\253141.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:1560
                      • C:\Users\Admin\AppData\Roaming\Download\253141.exe
                        "C:\Users\Admin\AppData\Roaming\Download\253141.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:2944
                    • C:\Users\Admin\AppData\Roaming\Download\154692.exe
                      "C:\Users\Admin\AppData\Roaming\Download\154692.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4364
                      • C:\Users\Admin\AppData\Roaming\Download\154692.exe
                        "C:\Users\Admin\AppData\Roaming\Download\154692.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5736
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                  2⤵
                  • Drops file in Program Files directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3524
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff8f45ec188,0x7ff8f45ec194,0x7ff8f45ec1a0
                    3⤵
                      PID:4344
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,4318688452667786338,4236008968363832050,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
                      3⤵
                      • System Time Discovery
                      PID:4072
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,13006936373477654794,5534807065647641587,262144 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
                      3⤵
                        PID:420
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,4920106062540635276,7663600121177702903,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
                        3⤵
                          PID:5016
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,6814078810092357592,10965770619563695114,2097152 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
                          3⤵
                            PID:1752
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,6893744906345237147,17790832761171338500,2097152 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                            3⤵
                              PID:1952
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,13907389977241838030,9578387463198979916,2097152 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
                              3⤵
                                PID:4784
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,8770212515514673265,1080073623549258399,2097152 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
                                3⤵
                                  PID:1976
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,5077253387113539139,12874396988568984233,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
                                  3⤵
                                    PID:4924
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6506012388379898898,12869735177577721749,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
                                    3⤵
                                      PID:2596
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5336,i,3084290760279215576,4965222315441528422,2097152 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
                                      3⤵
                                        PID:1540
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,6989226948036371835,16246613998023952331,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
                                        3⤵
                                          PID:2628
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,150362421358282904,5511592219389686213,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                          3⤵
                                            PID:372
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,9428035703097948699,1261022804037822207,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
                                            3⤵
                                              PID:2904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,9428035703097948699,1261022804037822207,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
                                              3⤵
                                                PID:1600
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,7803273244795401358,13800726207138721115,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
                                                3⤵
                                                  PID:4552
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,57752475153089370,6146870722484371639,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
                                                  3⤵
                                                    PID:220
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,12008069603514766574,18155883570770207095,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
                                                    3⤵
                                                      PID:4124
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3438266157460476958,2753652012667546948,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
                                                      3⤵
                                                        PID:3856
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10553005745956406598,7479765303049453908,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
                                                        3⤵
                                                          PID:1964
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,10967553522951138049,7219789439003012116,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
                                                          3⤵
                                                          • Modifies registry class
                                                          PID:948
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,11116656904088664843,5939652765322419834,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
                                                          3⤵
                                                            PID:860
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6780,i,1127226497117880395,11781933213857995036,2097152 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
                                                            3⤵
                                                              PID:3456
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,15911736748792684907,814270993679092137,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
                                                              3⤵
                                                                PID:5512
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,10803082445016887695,17595434737267959596,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
                                                                3⤵
                                                                  PID:5520
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,13881465660856744621,15315269456018696448,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
                                                                  3⤵
                                                                    PID:5252
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16872784903757769646,5048381449736941402,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
                                                                    3⤵
                                                                      PID:4128
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,1034691277114492433,6651181397133892781,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                                                      3⤵
                                                                        PID:6088
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,1148346197839829144,16936157063083374397,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
                                                                        3⤵
                                                                          PID:4616
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,992294659133765796,600223663084961583,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                                                          3⤵
                                                                            PID:4640
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4568,i,6209705506895085689,14162804750934265004,262144 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
                                                                            3⤵
                                                                              PID:4480
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,96372620866031164,6563680634318702733,524288 --field-trial-handle=2212,i,12832597967886438447,5284831761938038486,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
                                                                              3⤵
                                                                                PID:1008
                                                                            • C:\Windows\explorer.exe
                                                                              "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                              2⤵
                                                                                PID:936
                                                                            • C:\Windows\explorer.exe
                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                              1⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4372
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                2⤵
                                                                                  PID:2636
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:2524

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v16

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      DouTuDaShi.exe
                                                                                      • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                      • Size 1.1MB
                                                                                      • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3524_1344827938\manifest.json
                                                                                      • Size 165B
                                                                                      • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3524_1673353999\manifest.json
                                                                                      • Size 135B
                                                                                      • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3524_436694422\manifest.json
                                                                                      • Size 160B
                                                                                      • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3524_752965434\manifest.json
                                                                                      • Size 43B
                                                                                      • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      protocols.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                      • Size 3KB
                                                                                      • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      settings.dat
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      • Size 280B
                                                                                      • SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      BookmarkMergedSurfaceOrdering
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                      • Size 6B
                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 4KB
                                                                                      • SHA256 1325e68ad6d1130cba3fcb99ddee5008fff094c4d72c573b021eb7204ffa472d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      SiteList-Enterprise.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                      • Size 2B
                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Edge Profile.ico
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                      • Size 70KB
                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      HubApps
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                      • Size 106KB
                                                                                      • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      60b0d742-387b-4cd7-a57c-7f69451f8f73.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\60b0d742-387b-4cd7-a57c-7f69451f8f73.tmp
                                                                                      • Size 5KB
                                                                                      • SHA256 d923448ef708384d6d2511ea999131f0e467cc449ac3df00731ec5648fec0c8f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Network Persistent State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 111B
                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      SCT Auditing Pending Reports
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                      • Size 2B
                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 14KB
                                                                                      • SHA256 4afc2f66ebf01f01aad9e2a4e76bc9208f651aaf26bcf92bb13345375e7f2d94
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 15KB
                                                                                      • SHA256 b85584a33067bcee5ac4597e1fe2f3b155d693f1cf60de8c609b81ed7d62a2a9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Secure Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                      • Size 35KB
                                                                                      • SHA256 130b07a2724fc7075ccaf255434d5c28b892d5b322ec5cfa075e02f65bf4404a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      sync_diagnostic.log
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                      • Size 5KB
                                                                                      • SHA256 ad314ee3de9c2ed3ea10e612ab2163972c557db761e45e191bcc06a2866fc1c9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      4d8133e5-8da8-4790-bba6-8fca754c44f8.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4d8133e5-8da8-4790-bba6-8fca754c44f8.tmp
                                                                                      • Size 22KB
                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      office_endpoints_list.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                      • Size 9KB
                                                                                      • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 11KB
                                                                                      • SHA256 b0e4351af71654a6928a2f23fb8348feb591ae8fe0dcb683c3a782e12a4806f5
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 30KB
                                                                                      • SHA256 ec14e196aa703857acaf31e5d33422dc7033b3ac2cf027f682004ed13e4b5db0
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 19KB
                                                                                      • SHA256 aeaf13cedd6dc1f297d16b9ef53bfa3b3119bdda85a456656d5d9b37574e13cd
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 8KB
                                                                                      • SHA256 26a0a334d0b8da3c20131c6cd610bd4177a9333a160102c90ab6ee554fada6bc
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 8KB
                                                                                      • SHA256 82f2ea266e1a627396dd5fb146445cad984db6db634a05f8bbbbf4b80cc2c578
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      nav_config.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                      • Size 2KB
                                                                                      • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                      • Size 372B
                                                                                      • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                      • Size 252B
                                                                                      • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                      • Size 132B
                                                                                      • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                      • Size 492B
                                                                                      • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                      • Size 13B
                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                      • Size 2KB
                                                                                      • SHA256 9edd802a7e6002d262212e760eed39407261d1a1cfbabedcdcbf57e682f91133
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      4f093839-6314-4bd6-832a-1cc057f7e929.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4f093839-6314-4bd6-832a-1cc057f7e929.tmp
                                                                                      • Size 1B
                                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      ac429502-58cd-4403-820c-890ccfbba773.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ac429502-58cd-4403-820c-890ccfbba773.tmp
                                                                                      • Size 10KB
                                                                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      ldsajdklsajdlkjsalkda.bat
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                      • Size 589B
                                                                                      • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      motkqg.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\motkqg.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 14387ba7eee28e430dc2eff420b5337987675bd72f8cf00632187d3468534a0b
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      676daac6-633e-4157-9b84-7b3024218dbe.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3524_1474255697\676daac6-633e-4157-9b84-7b3024218dbe.tmp
                                                                                      • Size 152KB
                                                                                      • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      content_new.js
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3524_254194850\CRX_INSTALL\content_new.js
                                                                                      • Size 10KB
                                                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      044113.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\044113.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 f0800b4e6a53fa0603078ad16431fa746ce39bb5e4abe11c42c65bed1a7ac51d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      067405.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\067405.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 009ed3840d3ab7ceb84cd1d968c216d786dd183c584b49bda3453a1e2c9627b6
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      212085.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\212085.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 1ed7772da7730ef785181d61c6e95ee29e7d466f1556cc4f0ca3e61e4a699d0a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      244292.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\244292.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 abbb793de3a6e1743947d802f51b1525f2dea42a752dc03607a4b0c6d0e7d03f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      270729.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\270729.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 9e79d31e71aa959da9862de2f497dc93ab3b2592bf93330f1fdcfadee4d267fc
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      396279.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\396279.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 d7e6ac325e42a9e8ec4ea57b08d03df1175ce5500e2cffd734af898f441f1121
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      444141.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\444141.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 9faa2f9103b59d88e977575f7784a855272a92b1c4e4deaee997701ee12d055a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      819632.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\819632.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 76eb6e6fa8cf28865b163236cc3c8bacf4967cfd9e1408e7ddebdfa05959b93a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      831998.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\831998.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 9bc5d4fe45bdc7ef34ea7039e9bc1eef75720773872e0f8780977a10823f8686
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      856054.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\856054.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 25af269c332cd5096df20de17a43c93111e081fb9a538473d2bc4a7d651f472d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      887195.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\887195.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 086bbfb5653aae30c1ba53f53fb511e7837d8a4e9b3b6f43a112bed10c882613
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      942560.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\942560.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 2a5c823f8400675b150c4ea7fb43c7d2738ee770204f1aacf2b6ac5b68c830e8
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      memory/4592-459-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1067-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1236-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-812-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1287-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1191-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1128-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1343-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-569-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-712-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5104-1402-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download