Overview

overview

7

Static

static

3

2026-08-09...op.exe

windows10-2004-x64

7

2026-08-09...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 21:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_e8fda19ffe2f75b067e803137ed30d5a_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260809-1js2vswdpd
  • SHA256 dab301a577ecf0836ce589ed20771744f84f161283863dcd4d698e3d26b00e5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 50 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_e8fda19ffe2f75b067e803137ed30d5a_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e8fda19ffe2f75b067e803137ed30d5a_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4976
    • C:\Users\Admin\AppData\Local\Temp\bnsvmp.exe
      "C:\Users\Admin\AppData\Local\Temp\bnsvmp.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Users\Admin\AppData\Local\Temp\bnsvmp.exe
        "C:\Users\Admin\AppData\Local\Temp\bnsvmp.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Users\Admin\AppData\Roaming\Download\359240.exe
          "C:\Users\Admin\AppData\Roaming\Download\359240.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Users\Admin\AppData\Roaming\Download\359240.exe
            "C:\Users\Admin\AppData\Roaming\Download\359240.exe"
            5⤵
            • Executes dropped EXE
            PID:1160
        • C:\Users\Admin\AppData\Roaming\Download\664839.exe
          "C:\Users\Admin\AppData\Roaming\Download\664839.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3120
          • C:\Users\Admin\AppData\Roaming\Download\664839.exe
            "C:\Users\Admin\AppData\Roaming\Download\664839.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1248
        • C:\Users\Admin\AppData\Roaming\Download\712812.exe
          "C:\Users\Admin\AppData\Roaming\Download\712812.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Users\Admin\AppData\Roaming\Download\712812.exe
            "C:\Users\Admin\AppData\Roaming\Download\712812.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2040
        • C:\Users\Admin\AppData\Roaming\Download\793263.exe
          "C:\Users\Admin\AppData\Roaming\Download\793263.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:540
          • C:\Users\Admin\AppData\Roaming\Download\793263.exe
            "C:\Users\Admin\AppData\Roaming\Download\793263.exe"
            5⤵
            • Executes dropped EXE
            PID:4992
        • C:\Users\Admin\AppData\Roaming\Download\077144.exe
          "C:\Users\Admin\AppData\Roaming\Download\077144.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Users\Admin\AppData\Roaming\Download\077144.exe
            "C:\Users\Admin\AppData\Roaming\Download\077144.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3536
        • C:\Users\Admin\AppData\Roaming\Download\854770.exe
          "C:\Users\Admin\AppData\Roaming\Download\854770.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Users\Admin\AppData\Roaming\Download\854770.exe
            "C:\Users\Admin\AppData\Roaming\Download\854770.exe"
            5⤵
            • Executes dropped EXE
            PID:1960
        • C:\Users\Admin\AppData\Roaming\Download\900750.exe
          "C:\Users\Admin\AppData\Roaming\Download\900750.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4696
          • C:\Users\Admin\AppData\Roaming\Download\900750.exe
            "C:\Users\Admin\AppData\Roaming\Download\900750.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3604
        • C:\Users\Admin\AppData\Roaming\Download\123018.exe
          "C:\Users\Admin\AppData\Roaming\Download\123018.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Users\Admin\AppData\Roaming\Download\123018.exe
            "C:\Users\Admin\AppData\Roaming\Download\123018.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:368
        • C:\Users\Admin\AppData\Roaming\Download\116367.exe
          "C:\Users\Admin\AppData\Roaming\Download\116367.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4784
          • C:\Users\Admin\AppData\Roaming\Download\116367.exe
            "C:\Users\Admin\AppData\Roaming\Download\116367.exe"
            5⤵
            • Executes dropped EXE
            PID:368
        • C:\Users\Admin\AppData\Roaming\Download\261440.exe
          "C:\Users\Admin\AppData\Roaming\Download\261440.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1496
          • C:\Users\Admin\AppData\Roaming\Download\261440.exe
            "C:\Users\Admin\AppData\Roaming\Download\261440.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2912
        • C:\Users\Admin\AppData\Roaming\Download\484506.exe
          "C:\Users\Admin\AppData\Roaming\Download\484506.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1044
          • C:\Users\Admin\AppData\Roaming\Download\484506.exe
            "C:\Users\Admin\AppData\Roaming\Download\484506.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3368
        • C:\Users\Admin\AppData\Roaming\Download\874420.exe
          "C:\Users\Admin\AppData\Roaming\Download\874420.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4372
          • C:\Users\Admin\AppData\Roaming\Download\874420.exe
            "C:\Users\Admin\AppData\Roaming\Download\874420.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4656
        • C:\Users\Admin\AppData\Roaming\Download\060218.exe
          "C:\Users\Admin\AppData\Roaming\Download\060218.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:220
          • C:\Users\Admin\AppData\Roaming\Download\060218.exe
            "C:\Users\Admin\AppData\Roaming\Download\060218.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1504
        • C:\Users\Admin\AppData\Roaming\Download\708037.exe
          "C:\Users\Admin\AppData\Roaming\Download\708037.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3872
          • C:\Users\Admin\AppData\Roaming\Download\708037.exe
            "C:\Users\Admin\AppData\Roaming\Download\708037.exe"
            5⤵
            • Executes dropped EXE
            PID:1716
        • C:\Users\Admin\AppData\Roaming\Download\430556.exe
          "C:\Users\Admin\AppData\Roaming\Download\430556.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3184
          • C:\Users\Admin\AppData\Roaming\Download\430556.exe
            "C:\Users\Admin\AppData\Roaming\Download\430556.exe"
            5⤵
            • Executes dropped EXE
            PID:4752
        • C:\Users\Admin\AppData\Roaming\Download\176275.exe
          "C:\Users\Admin\AppData\Roaming\Download\176275.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2420
          • C:\Users\Admin\AppData\Roaming\Download\176275.exe
            "C:\Users\Admin\AppData\Roaming\Download\176275.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2620
        • C:\Users\Admin\AppData\Roaming\Download\119331.exe
          "C:\Users\Admin\AppData\Roaming\Download\119331.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4436
          • C:\Users\Admin\AppData\Roaming\Download\119331.exe
            "C:\Users\Admin\AppData\Roaming\Download\119331.exe"
            5⤵
            • Executes dropped EXE
            PID:2936
        • C:\Users\Admin\AppData\Roaming\Download\719045.exe
          "C:\Users\Admin\AppData\Roaming\Download\719045.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4176
          • C:\Users\Admin\AppData\Roaming\Download\719045.exe
            "C:\Users\Admin\AppData\Roaming\Download\719045.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2664
        • C:\Users\Admin\AppData\Roaming\Download\731311.exe
          "C:\Users\Admin\AppData\Roaming\Download\731311.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3036
          • C:\Users\Admin\AppData\Roaming\Download\731311.exe
            "C:\Users\Admin\AppData\Roaming\Download\731311.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4152
        • C:\Users\Admin\AppData\Roaming\Download\615662.exe
          "C:\Users\Admin\AppData\Roaming\Download\615662.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2084
          • C:\Users\Admin\AppData\Roaming\Download\615662.exe
            "C:\Users\Admin\AppData\Roaming\Download\615662.exe"
            5⤵
            • Executes dropped EXE
            PID:816
        • C:\Users\Admin\AppData\Roaming\Download\957828.exe
          "C:\Users\Admin\AppData\Roaming\Download\957828.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1124
          • C:\Users\Admin\AppData\Roaming\Download\957828.exe
            "C:\Users\Admin\AppData\Roaming\Download\957828.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2380
        • C:\Users\Admin\AppData\Roaming\Download\989186.exe
          "C:\Users\Admin\AppData\Roaming\Download\989186.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1788
          • C:\Users\Admin\AppData\Roaming\Download\989186.exe
            "C:\Users\Admin\AppData\Roaming\Download\989186.exe"
            5⤵
            • Executes dropped EXE
            PID:3520
        • C:\Users\Admin\AppData\Roaming\Download\370898.exe
          "C:\Users\Admin\AppData\Roaming\Download\370898.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2076
          • C:\Users\Admin\AppData\Roaming\Download\370898.exe
            "C:\Users\Admin\AppData\Roaming\Download\370898.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2908
        • C:\Users\Admin\AppData\Roaming\Download\868512.exe
          "C:\Users\Admin\AppData\Roaming\Download\868512.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2664
          • C:\Users\Admin\AppData\Roaming\Download\868512.exe
            "C:\Users\Admin\AppData\Roaming\Download\868512.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2576
        • C:\Users\Admin\AppData\Roaming\Download\975670.exe
          "C:\Users\Admin\AppData\Roaming\Download\975670.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1228
          • C:\Users\Admin\AppData\Roaming\Download\975670.exe
            "C:\Users\Admin\AppData\Roaming\Download\975670.exe"
            5⤵
            • Executes dropped EXE
            PID:3496
        • C:\Users\Admin\AppData\Roaming\Download\140478.exe
          "C:\Users\Admin\AppData\Roaming\Download\140478.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4240
          • C:\Users\Admin\AppData\Roaming\Download\140478.exe
            "C:\Users\Admin\AppData\Roaming\Download\140478.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2912
        • C:\Users\Admin\AppData\Roaming\Download\398650.exe
          "C:\Users\Admin\AppData\Roaming\Download\398650.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1552
          • C:\Users\Admin\AppData\Roaming\Download\398650.exe
            "C:\Users\Admin\AppData\Roaming\Download\398650.exe"
            5⤵
            • Executes dropped EXE
            PID:2280
        • C:\Users\Admin\AppData\Roaming\Download\530716.exe
          "C:\Users\Admin\AppData\Roaming\Download\530716.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1008
          • C:\Users\Admin\AppData\Roaming\Download\530716.exe
            "C:\Users\Admin\AppData\Roaming\Download\530716.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3876
        • C:\Users\Admin\AppData\Roaming\Download\421167.exe
          "C:\Users\Admin\AppData\Roaming\Download\421167.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4152
          • C:\Users\Admin\AppData\Roaming\Download\421167.exe
            "C:\Users\Admin\AppData\Roaming\Download\421167.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1560
        • C:\Users\Admin\AppData\Roaming\Download\953696.exe
          "C:\Users\Admin\AppData\Roaming\Download\953696.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3568
          • C:\Users\Admin\AppData\Roaming\Download\953696.exe
            "C:\Users\Admin\AppData\Roaming\Download\953696.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:872
        • C:\Users\Admin\AppData\Roaming\Download\899405.exe
          "C:\Users\Admin\AppData\Roaming\Download\899405.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1696
          • C:\Users\Admin\AppData\Roaming\Download\899405.exe
            "C:\Users\Admin\AppData\Roaming\Download\899405.exe"
            5⤵
              PID:4344
          • C:\Users\Admin\AppData\Roaming\Download\812561.exe
            "C:\Users\Admin\AppData\Roaming\Download\812561.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:2604
            • C:\Users\Admin\AppData\Roaming\Download\812561.exe
              "C:\Users\Admin\AppData\Roaming\Download\812561.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4208
          • C:\Users\Admin\AppData\Roaming\Download\009569.exe
            "C:\Users\Admin\AppData\Roaming\Download\009569.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:2936
            • C:\Users\Admin\AppData\Roaming\Download\009569.exe
              "C:\Users\Admin\AppData\Roaming\Download\009569.exe"
              5⤵
                PID:4608
            • C:\Users\Admin\AppData\Roaming\Download\341625.exe
              "C:\Users\Admin\AppData\Roaming\Download\341625.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:5028
              • C:\Users\Admin\AppData\Roaming\Download\341625.exe
                "C:\Users\Admin\AppData\Roaming\Download\341625.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1076
            • C:\Users\Admin\AppData\Roaming\Download\225176.exe
              "C:\Users\Admin\AppData\Roaming\Download\225176.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:1864
              • C:\Users\Admin\AppData\Roaming\Download\225176.exe
                "C:\Users\Admin\AppData\Roaming\Download\225176.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4908
            • C:\Users\Admin\AppData\Roaming\Download\257432.exe
              "C:\Users\Admin\AppData\Roaming\Download\257432.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:2872
              • C:\Users\Admin\AppData\Roaming\Download\257432.exe
                "C:\Users\Admin\AppData\Roaming\Download\257432.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2684
            • C:\Users\Admin\AppData\Roaming\Download\534239.exe
              "C:\Users\Admin\AppData\Roaming\Download\534239.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:3512
              • C:\Users\Admin\AppData\Roaming\Download\534239.exe
                "C:\Users\Admin\AppData\Roaming\Download\534239.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4952
            • C:\Users\Admin\AppData\Roaming\Download\645480.exe
              "C:\Users\Admin\AppData\Roaming\Download\645480.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:1384
              • C:\Users\Admin\AppData\Roaming\Download\645480.exe
                "C:\Users\Admin\AppData\Roaming\Download\645480.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2920
            • C:\Users\Admin\AppData\Roaming\Download\771663.exe
              "C:\Users\Admin\AppData\Roaming\Download\771663.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:820
              • C:\Users\Admin\AppData\Roaming\Download\771663.exe
                "C:\Users\Admin\AppData\Roaming\Download\771663.exe"
                5⤵
                  PID:1308
              • C:\Users\Admin\AppData\Roaming\Download\058450.exe
                "C:\Users\Admin\AppData\Roaming\Download\058450.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3412
                • C:\Users\Admin\AppData\Roaming\Download\058450.exe
                  "C:\Users\Admin\AppData\Roaming\Download\058450.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4608
              • C:\Users\Admin\AppData\Roaming\Download\036085.exe
                "C:\Users\Admin\AppData\Roaming\Download\036085.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:2920
                • C:\Users\Admin\AppData\Roaming\Download\036085.exe
                  "C:\Users\Admin\AppData\Roaming\Download\036085.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2608
              • C:\Users\Admin\AppData\Roaming\Download\949435.exe
                "C:\Users\Admin\AppData\Roaming\Download\949435.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:4908
                • C:\Users\Admin\AppData\Roaming\Download\949435.exe
                  "C:\Users\Admin\AppData\Roaming\Download\949435.exe"
                  5⤵
                    PID:4308
                • C:\Users\Admin\AppData\Roaming\Download\104223.exe
                  "C:\Users\Admin\AppData\Roaming\Download\104223.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:2848
                  • C:\Users\Admin\AppData\Roaming\Download\104223.exe
                    "C:\Users\Admin\AppData\Roaming\Download\104223.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2108
                • C:\Users\Admin\AppData\Roaming\Download\358399.exe
                  "C:\Users\Admin\AppData\Roaming\Download\358399.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:2892
                  • C:\Users\Admin\AppData\Roaming\Download\358399.exe
                    "C:\Users\Admin\AppData\Roaming\Download\358399.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1108
                • C:\Users\Admin\AppData\Roaming\Download\574571.exe
                  "C:\Users\Admin\AppData\Roaming\Download\574571.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:2708
                  • C:\Users\Admin\AppData\Roaming\Download\574571.exe
                    "C:\Users\Admin\AppData\Roaming\Download\574571.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2608
                • C:\Users\Admin\AppData\Roaming\Download\485822.exe
                  "C:\Users\Admin\AppData\Roaming\Download\485822.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:4368
                  • C:\Users\Admin\AppData\Roaming\Download\485822.exe
                    "C:\Users\Admin\AppData\Roaming\Download\485822.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4596
                • C:\Users\Admin\AppData\Roaming\Download\952810.exe
                  "C:\Users\Admin\AppData\Roaming\Download\952810.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:2080
                  • C:\Users\Admin\AppData\Roaming\Download\952810.exe
                    "C:\Users\Admin\AppData\Roaming\Download\952810.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2412
                • C:\Users\Admin\AppData\Roaming\Download\272584.exe
                  "C:\Users\Admin\AppData\Roaming\Download\272584.exe" /Shorttailedrestart
                  4⤵
                    PID:4168
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                2⤵
                • Drops file in Program Files directory
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4872
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffc5c54c188,0x7ffc5c54c194,0x7ffc5c54c1a0
                  3⤵
                    PID:3576
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5564327153564341377,1088641682690378739,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
                    3⤵
                    • System Time Discovery
                    PID:1812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8290061747028143851,11232657778793970895,262144 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
                    3⤵
                      PID:2436
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,111992052796512181,12304125669712029085,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
                      3⤵
                        PID:3856
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14644902752094066231,4273076707130576901,2097152 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                        3⤵
                          PID:4400
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1163765756648224807,15406976624005667463,2097152 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
                          3⤵
                            PID:3876
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,9289732413022701001,7042366794481551634,2097152 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
                            3⤵
                              PID:3000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,10983688776906758213,9681834682359783881,2097152 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
                              3⤵
                                PID:2996
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,13614681150491141757,735698980607773366,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
                                3⤵
                                  PID:4156
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,17247605723736161676,4837631533211337234,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
                                  3⤵
                                    PID:1744
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,481489452747456207,17609425637846859544,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
                                    3⤵
                                      PID:1308
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,1364737615903936208,3639849227191803836,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
                                      3⤵
                                        PID:988
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5620361019316293010,7376662900819042028,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
                                        3⤵
                                          PID:820
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5620361019316293010,7376662900819042028,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
                                          3⤵
                                            PID:1592
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6507034288500055682,1357968686065809930,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
                                            3⤵
                                              PID:1904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,2468180980076987749,18214328798023576036,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
                                              3⤵
                                                PID:1468
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13319782538770756820,8449504857313022408,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
                                                3⤵
                                                  PID:2488
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,16414237682125393826,4643464939874001138,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
                                                  3⤵
                                                    PID:1728
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,6820243221417111002,14548287724830388802,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
                                                    3⤵
                                                      PID:2896
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6592,i,17822889880027989407,9554313778115587038,2097152 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
                                                      3⤵
                                                        PID:4636
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,4062366161845215868,11146462807844763700,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
                                                        3⤵
                                                          PID:1504
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8778603706474704059,16372149162261617414,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
                                                          3⤵
                                                            PID:2564
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,3585468484568487232,13852926091788325504,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
                                                            3⤵
                                                              PID:3516
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,14012946235530498805,2672267422620011147,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
                                                              3⤵
                                                                PID:3292
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,8027690412537175732,5297024047093540041,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
                                                                3⤵
                                                                  PID:2408
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,15979677164807071075,1212863501424757347,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
                                                                  3⤵
                                                                    PID:2280
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,4304778061286074072,2834636587532331121,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=856 /prefetch:8
                                                                    3⤵
                                                                      PID:3972
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,13202118274908882000,15823031678309164115,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
                                                                      3⤵
                                                                        PID:3544
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3628,i,14802985771102927306,10829347243234056617,262144 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
                                                                        3⤵
                                                                          PID:4296
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,11623512494617851721,5463877996081289479,524288 --field-trial-handle=2488,i,10730744206196394826,7634194441564347699,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
                                                                          3⤵
                                                                            PID:952
                                                                        • C:\Windows\explorer.exe
                                                                          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                          2⤵
                                                                            PID:1996
                                                                        • C:\Windows\explorer.exe
                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                          1⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2024
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                            2⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:2412
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                          1⤵
                                                                            PID:1948

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                DouTuDaShi.exe
                                                                                • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                • Size 1.1MB
                                                                                • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4872_1148279450\manifest.json
                                                                                • Size 43B
                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4872_1445209713\manifest.json
                                                                                • Size 165B
                                                                                • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4872_1449402319\manifest.json
                                                                                • Size 135B
                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                manifest.json
                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4872_880439559\manifest.json
                                                                                • Size 160B
                                                                                • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                protocols.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                • Size 3KB
                                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 3KB
                                                                                • SHA256 ee0e766b11e073b856661fddb221a4f54afc463669f0f78cfdf9b0fe3a09db90
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index~RFe589313.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589313.TMP
                                                                                • Size 3KB
                                                                                • SHA256 b2c61e7676927b0afa90fb1e65274644dff0ec5c004cd2a48968a4be6b338a50
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                SiteList-Enterprise.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                • Size 2B
                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Edge Profile.ico
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                • Size 70KB
                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Network Persistent State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                • Size 111B
                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Network Persistent State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                • Size 2KB
                                                                                • SHA256 f7e81b6e929d2c23ef3a34472b59c45b4230f3513b07ebd63de94c1a6c76d4be
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                SCT Auditing Pending Reports
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                • Size 2B
                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 13KB
                                                                                • SHA256 60b0bfd3ff52e791d1e3d5ba5400e3bfe96c4600d89db2135014760f52a280ce
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 13KB
                                                                                • SHA256 8ebd019c1ed8e0b00b8b44e183ea278e39cee519587343b65bd2677e660b3e4a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 14KB
                                                                                • SHA256 d87a1cee092acf637b705b7b3011d4e30b5edba8da9301e6bf00f64dff7d5901
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Secure Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                • Size 35KB
                                                                                • SHA256 efc142a23d00d7fc1fc9f54dfe821f93e67bfb3f01ab511336f3b34a20872d7c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                sync_diagnostic.log
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                • Size 4KB
                                                                                • SHA256 ec4629bcdc3f771a9d7896f142df12095b80405f9e6d83daa24c9ebb86cde127
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                OperationConfig
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                • Size 22KB
                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                OperationConfig~RFe592eb7.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592eb7.TMP
                                                                                • Size 3KB
                                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                office_endpoints_list.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                • Size 9KB
                                                                                • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 15KB
                                                                                • SHA256 f92c735e990ce2f0b2bf2ff3c396901f4f4ff9c8ac46227c6ea95986358003c0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 8KB
                                                                                • SHA256 4bd2f1c4bf3c178eb40373ad7a45aa717186bed9afb8f75ab8e79b3a97862be5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 15KB
                                                                                • SHA256 f607f96e9c4e9d595800425e4321d27de1a9130696657e8a43acd565e04b6ef4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 26KB
                                                                                • SHA256 47476e340d9f90f8115bd2cd52e7358778454c9dcac0e085cefe4543cfdfa0d5
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 9KB
                                                                                • SHA256 6fe8b205adc960560c93d54a989b4595d471a604e10a7d7701004b6ee0f5a1f6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                nav_config.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                • Size 2KB
                                                                                • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 372B
                                                                                • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 132B
                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 252B
                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 492B
                                                                                • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                • Size 13B
                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                • Size 2KB
                                                                                • SHA256 54b16dd9333d62216c6a839147118fed22ab4655f13029cf44bb4285a97ab9bc
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                19d8755e-47c0-46bb-81d0-5012b4d8655b.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\19d8755e-47c0-46bb-81d0-5012b4d8655b.tmp
                                                                                • Size 10KB
                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                843c28bc-68b4-4313-bc6b-abc3788ac7e6.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\843c28bc-68b4-4313-bc6b-abc3788ac7e6.tmp
                                                                                • Size 1B
                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                bnsvmp.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\bnsvmp.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 dab301a577ecf0836ce589ed20771744f84f161283863dcd4d698e3d26b00e5b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                ldsajdklsajdlkjsalkda.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                • Size 589B
                                                                                • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                881f7ac7-82e5-4c9e-9d79-6156e1030eec.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4872_1463247274\881f7ac7-82e5-4c9e-9d79-6156e1030eec.tmp
                                                                                • Size 153KB
                                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                content_new.js
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4872_703567211\CRX_INSTALL\content_new.js
                                                                                • Size 10KB
                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                060218.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\060218.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 e2b415e883505ae49e4d3fe22f024e281dc129d2d2aff998ac26824ac4278fea
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                077144.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\077144.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 d5bb8e93987e81d183da685221a7d1906f8663308481cbbe37b5faca432d4df9
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                116367.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\116367.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 d82f012cb32bcf9479a340d370bf5f4844a66713649d629061e39da5a5885386
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                123018.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\123018.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 32bb6dc57522e3a7a3f9eb8c7f50cd1ee07704b15a78e28b8d9f72bcf83a2f76
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                261440.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\261440.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 51c28adf71fd3539ca4b6a1a93680e243227e87792188f06f1bc87f83c3e9591
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                359240.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\359240.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 19f73046c844ca69a8c95cfc33c99d7ddf7d37a7cf26691573a8bc20481c3a78
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                484506.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\484506.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 99bfe9cea66d30e42675e11881991c4c8cfe9326cb099ce017f4e27172953a39
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                664839.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\664839.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 601f1bf8af706175626deac67485afd780ce2a08d3956833b2d88d1ffb58855d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                712812.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\712812.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 ffe3515ea833d37d9231d8d889c76190d3bb3995995c25ae2171d194925c965d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                793263.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\793263.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 424c05343ab134b86fe2ab5ca105ae375d3d1f6b5d0cb86c048858ce3179d505
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                854770.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\854770.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 162813da8728df450671f0b5cfcc24595025e108220a995625f83c96f284fe46
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                874420.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\874420.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 8fa2bdf0a023ab600acb9ac8d40790fc182545695425ca08b8b967de9a52a9fe
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                900750.exe
                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\900750.exe
                                                                                • Size 1.5MB
                                                                                • SHA256 9c73ee22ed2d50cd622a7daddeb30d26e12e1411b04bb8bb727af793b9e272f3
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                memory/3456-225-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-825-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-1063-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-1007-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-504-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-1119-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-946-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-619-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-871-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-1227-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-789-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download

                                                                                memory/4300-694-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                Download