Overview

overview

7

Static

static

3

2026-08-25...op.exe

windows10-2004-x64

7

2026-08-25...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/08/2026, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_f4b09e7ef76c05d3a45973bfee1100fb_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260826-ce9xtabd73
  • SHA256 074a922ef53d5b36ef1564f69b2ebae4f13a9b39e6bb24f3988dabbc8d4ad536
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_f4b09e7ef76c05d3a45973bfee1100fb_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_f4b09e7ef76c05d3a45973bfee1100fb_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4492
    • C:\Users\Admin\AppData\Local\Temp\eklzet.exe
      "C:\Users\Admin\AppData\Local\Temp\eklzet.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Users\Admin\AppData\Local\Temp\eklzet.exe
        "C:\Users\Admin\AppData\Local\Temp\eklzet.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Users\Admin\AppData\Roaming\Download\840793.exe
          "C:\Users\Admin\AppData\Roaming\Download\840793.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4928
          • C:\Users\Admin\AppData\Roaming\Download\840793.exe
            "C:\Users\Admin\AppData\Roaming\Download\840793.exe"
            5⤵
            • Executes dropped EXE
            PID:644
        • C:\Users\Admin\AppData\Roaming\Download\068006.exe
          "C:\Users\Admin\AppData\Roaming\Download\068006.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3748
          • C:\Users\Admin\AppData\Roaming\Download\068006.exe
            "C:\Users\Admin\AppData\Roaming\Download\068006.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3672
        • C:\Users\Admin\AppData\Roaming\Download\455096.exe
          "C:\Users\Admin\AppData\Roaming\Download\455096.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2188
          • C:\Users\Admin\AppData\Roaming\Download\455096.exe
            "C:\Users\Admin\AppData\Roaming\Download\455096.exe"
            5⤵
            • Executes dropped EXE
            PID:4988
        • C:\Users\Admin\AppData\Roaming\Download\336245.exe
          "C:\Users\Admin\AppData\Roaming\Download\336245.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5656
          • C:\Users\Admin\AppData\Roaming\Download\336245.exe
            "C:\Users\Admin\AppData\Roaming\Download\336245.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5744
        • C:\Users\Admin\AppData\Roaming\Download\489503.exe
          "C:\Users\Admin\AppData\Roaming\Download\489503.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2400
          • C:\Users\Admin\AppData\Roaming\Download\489503.exe
            "C:\Users\Admin\AppData\Roaming\Download\489503.exe"
            5⤵
            • Executes dropped EXE
            PID:5340
        • C:\Users\Admin\AppData\Roaming\Download\456167.exe
          "C:\Users\Admin\AppData\Roaming\Download\456167.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6108
          • C:\Users\Admin\AppData\Roaming\Download\456167.exe
            "C:\Users\Admin\AppData\Roaming\Download\456167.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4968
        • C:\Users\Admin\AppData\Roaming\Download\092581.exe
          "C:\Users\Admin\AppData\Roaming\Download\092581.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4304
          • C:\Users\Admin\AppData\Roaming\Download\092581.exe
            "C:\Users\Admin\AppData\Roaming\Download\092581.exe"
            5⤵
            • Executes dropped EXE
            PID:6100
        • C:\Users\Admin\AppData\Roaming\Download\630102.exe
          "C:\Users\Admin\AppData\Roaming\Download\630102.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6072
          • C:\Users\Admin\AppData\Roaming\Download\630102.exe
            "C:\Users\Admin\AppData\Roaming\Download\630102.exe"
            5⤵
            • Executes dropped EXE
            PID:5860
        • C:\Users\Admin\AppData\Roaming\Download\752468.exe
          "C:\Users\Admin\AppData\Roaming\Download\752468.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5832
          • C:\Users\Admin\AppData\Roaming\Download\752468.exe
            "C:\Users\Admin\AppData\Roaming\Download\752468.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5452
        • C:\Users\Admin\AppData\Roaming\Download\140275.exe
          "C:\Users\Admin\AppData\Roaming\Download\140275.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5588
          • C:\Users\Admin\AppData\Roaming\Download\140275.exe
            "C:\Users\Admin\AppData\Roaming\Download\140275.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5592
        • C:\Users\Admin\AppData\Roaming\Download\182441.exe
          "C:\Users\Admin\AppData\Roaming\Download\182441.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6124
          • C:\Users\Admin\AppData\Roaming\Download\182441.exe
            "C:\Users\Admin\AppData\Roaming\Download\182441.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4372
        • C:\Users\Admin\AppData\Roaming\Download\173982.exe
          "C:\Users\Admin\AppData\Roaming\Download\173982.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2284
          • C:\Users\Admin\AppData\Roaming\Download\173982.exe
            "C:\Users\Admin\AppData\Roaming\Download\173982.exe"
            5⤵
            • Executes dropped EXE
            PID:6024
        • C:\Users\Admin\AppData\Roaming\Download\560780.exe
          "C:\Users\Admin\AppData\Roaming\Download\560780.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5328
          • C:\Users\Admin\AppData\Roaming\Download\560780.exe
            "C:\Users\Admin\AppData\Roaming\Download\560780.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5020
        • C:\Users\Admin\AppData\Roaming\Download\441031.exe
          "C:\Users\Admin\AppData\Roaming\Download\441031.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5652
          • C:\Users\Admin\AppData\Roaming\Download\441031.exe
            "C:\Users\Admin\AppData\Roaming\Download\441031.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4488
        • C:\Users\Admin\AppData\Roaming\Download\221665.exe
          "C:\Users\Admin\AppData\Roaming\Download\221665.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5596
          • C:\Users\Admin\AppData\Roaming\Download\221665.exe
            "C:\Users\Admin\AppData\Roaming\Download\221665.exe"
            5⤵
            • Executes dropped EXE
            PID:3240
        • C:\Users\Admin\AppData\Roaming\Download\463921.exe
          "C:\Users\Admin\AppData\Roaming\Download\463921.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6128
          • C:\Users\Admin\AppData\Roaming\Download\463921.exe
            "C:\Users\Admin\AppData\Roaming\Download\463921.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4780
        • C:\Users\Admin\AppData\Roaming\Download\586087.exe
          "C:\Users\Admin\AppData\Roaming\Download\586087.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4484
          • C:\Users\Admin\AppData\Roaming\Download\586087.exe
            "C:\Users\Admin\AppData\Roaming\Download\586087.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5540
        • C:\Users\Admin\AppData\Roaming\Download\538353.exe
          "C:\Users\Admin\AppData\Roaming\Download\538353.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5996
          • C:\Users\Admin\AppData\Roaming\Download\538353.exe
            "C:\Users\Admin\AppData\Roaming\Download\538353.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3604
        • C:\Users\Admin\AppData\Roaming\Download\796140.exe
          "C:\Users\Admin\AppData\Roaming\Download\796140.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1892
          • C:\Users\Admin\AppData\Roaming\Download\796140.exe
            "C:\Users\Admin\AppData\Roaming\Download\796140.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5320
        • C:\Users\Admin\AppData\Roaming\Download\652860.exe
          "C:\Users\Admin\AppData\Roaming\Download\652860.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3328
          • C:\Users\Admin\AppData\Roaming\Download\652860.exe
            "C:\Users\Admin\AppData\Roaming\Download\652860.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4328
        • C:\Users\Admin\AppData\Roaming\Download\929857.exe
          "C:\Users\Admin\AppData\Roaming\Download\929857.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3240
          • C:\Users\Admin\AppData\Roaming\Download\929857.exe
            "C:\Users\Admin\AppData\Roaming\Download\929857.exe"
            5⤵
            • Executes dropped EXE
            PID:1396
        • C:\Users\Admin\AppData\Roaming\Download\822108.exe
          "C:\Users\Admin\AppData\Roaming\Download\822108.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6136
          • C:\Users\Admin\AppData\Roaming\Download\822108.exe
            "C:\Users\Admin\AppData\Roaming\Download\822108.exe"
            5⤵
            • Executes dropped EXE
            PID:4220
        • C:\Users\Admin\AppData\Roaming\Download\297996.exe
          "C:\Users\Admin\AppData\Roaming\Download\297996.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2424
          • C:\Users\Admin\AppData\Roaming\Download\297996.exe
            "C:\Users\Admin\AppData\Roaming\Download\297996.exe"
            5⤵
            • Executes dropped EXE
            PID:5292
        • C:\Users\Admin\AppData\Roaming\Download\290346.exe
          "C:\Users\Admin\AppData\Roaming\Download\290346.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5216
          • C:\Users\Admin\AppData\Roaming\Download\290346.exe
            "C:\Users\Admin\AppData\Roaming\Download\290346.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5604
        • C:\Users\Admin\AppData\Roaming\Download\630876.exe
          "C:\Users\Admin\AppData\Roaming\Download\630876.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2068
          • C:\Users\Admin\AppData\Roaming\Download\630876.exe
            "C:\Users\Admin\AppData\Roaming\Download\630876.exe"
            5⤵
            • Executes dropped EXE
            PID:2652
        • C:\Users\Admin\AppData\Roaming\Download\568695.exe
          "C:\Users\Admin\AppData\Roaming\Download\568695.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4940
          • C:\Users\Admin\AppData\Roaming\Download\568695.exe
            "C:\Users\Admin\AppData\Roaming\Download\568695.exe"
            5⤵
            • Executes dropped EXE
            PID:5148
        • C:\Users\Admin\AppData\Roaming\Download\856483.exe
          "C:\Users\Admin\AppData\Roaming\Download\856483.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5980
          • C:\Users\Admin\AppData\Roaming\Download\856483.exe
            "C:\Users\Admin\AppData\Roaming\Download\856483.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5468
        • C:\Users\Admin\AppData\Roaming\Download\747933.exe
          "C:\Users\Admin\AppData\Roaming\Download\747933.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5452
          • C:\Users\Admin\AppData\Roaming\Download\747933.exe
            "C:\Users\Admin\AppData\Roaming\Download\747933.exe"
            5⤵
            • Executes dropped EXE
            PID:5184
        • C:\Users\Admin\AppData\Roaming\Download\969091.exe
          "C:\Users\Admin\AppData\Roaming\Download\969091.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:452
          • C:\Users\Admin\AppData\Roaming\Download\969091.exe
            "C:\Users\Admin\AppData\Roaming\Download\969091.exe"
            5⤵
            • Executes dropped EXE
            PID:5672
        • C:\Users\Admin\AppData\Roaming\Download\524345.exe
          "C:\Users\Admin\AppData\Roaming\Download\524345.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1840
          • C:\Users\Admin\AppData\Roaming\Download\524345.exe
            "C:\Users\Admin\AppData\Roaming\Download\524345.exe"
            5⤵
            • Executes dropped EXE
            PID:6080
        • C:\Users\Admin\AppData\Roaming\Download\547601.exe
          "C:\Users\Admin\AppData\Roaming\Download\547601.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2196
          • C:\Users\Admin\AppData\Roaming\Download\547601.exe
            "C:\Users\Admin\AppData\Roaming\Download\547601.exe"
            5⤵
              PID:3012
          • C:\Users\Admin\AppData\Roaming\Download\283420.exe
            "C:\Users\Admin\AppData\Roaming\Download\283420.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:672
            • C:\Users\Admin\AppData\Roaming\Download\283420.exe
              "C:\Users\Admin\AppData\Roaming\Download\283420.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:960
          • C:\Users\Admin\AppData\Roaming\Download\915940.exe
            "C:\Users\Admin\AppData\Roaming\Download\915940.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:2760
            • C:\Users\Admin\AppData\Roaming\Download\915940.exe
              "C:\Users\Admin\AppData\Roaming\Download\915940.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5916
          • C:\Users\Admin\AppData\Roaming\Download\896291.exe
            "C:\Users\Admin\AppData\Roaming\Download\896291.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:5228
            • C:\Users\Admin\AppData\Roaming\Download\896291.exe
              "C:\Users\Admin\AppData\Roaming\Download\896291.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2972
          • C:\Users\Admin\AppData\Roaming\Download\042373.exe
            "C:\Users\Admin\AppData\Roaming\Download\042373.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:3764
            • C:\Users\Admin\AppData\Roaming\Download\042373.exe
              "C:\Users\Admin\AppData\Roaming\Download\042373.exe"
              5⤵
                PID:5272
            • C:\Users\Admin\AppData\Roaming\Download\439171.exe
              "C:\Users\Admin\AppData\Roaming\Download\439171.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5368
              • C:\Users\Admin\AppData\Roaming\Download\439171.exe
                "C:\Users\Admin\AppData\Roaming\Download\439171.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5700
            • C:\Users\Admin\AppData\Roaming\Download\451437.exe
              "C:\Users\Admin\AppData\Roaming\Download\451437.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5860
              • C:\Users\Admin\AppData\Roaming\Download\451437.exe
                "C:\Users\Admin\AppData\Roaming\Download\451437.exe"
                5⤵
                  PID:4128
              • C:\Users\Admin\AppData\Roaming\Download\607419.exe
                "C:\Users\Admin\AppData\Roaming\Download\607419.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:2532
                • C:\Users\Admin\AppData\Roaming\Download\607419.exe
                  "C:\Users\Admin\AppData\Roaming\Download\607419.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:6000
              • C:\Users\Admin\AppData\Roaming\Download\790960.exe
                "C:\Users\Admin\AppData\Roaming\Download\790960.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:2256
                • C:\Users\Admin\AppData\Roaming\Download\790960.exe
                  "C:\Users\Admin\AppData\Roaming\Download\790960.exe"
                  5⤵
                    PID:440
                • C:\Users\Admin\AppData\Roaming\Download\733026.exe
                  "C:\Users\Admin\AppData\Roaming\Download\733026.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:1264
                  • C:\Users\Admin\AppData\Roaming\Download\733026.exe
                    "C:\Users\Admin\AppData\Roaming\Download\733026.exe"
                    5⤵
                      PID:4028
                  • C:\Users\Admin\AppData\Roaming\Download\000814.exe
                    "C:\Users\Admin\AppData\Roaming\Download\000814.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:1344
                    • C:\Users\Admin\AppData\Roaming\Download\000814.exe
                      "C:\Users\Admin\AppData\Roaming\Download\000814.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5380
                  • C:\Users\Admin\AppData\Roaming\Download\101264.exe
                    "C:\Users\Admin\AppData\Roaming\Download\101264.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:4768
                    • C:\Users\Admin\AppData\Roaming\Download\101264.exe
                      "C:\Users\Admin\AppData\Roaming\Download\101264.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3276
                  • C:\Users\Admin\AppData\Roaming\Download\123520.exe
                    "C:\Users\Admin\AppData\Roaming\Download\123520.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:3400
                    • C:\Users\Admin\AppData\Roaming\Download\123520.exe
                      "C:\Users\Admin\AppData\Roaming\Download\123520.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4552
                  • C:\Users\Admin\AppData\Roaming\Download\379513.exe
                    "C:\Users\Admin\AppData\Roaming\Download\379513.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:3012
                    • C:\Users\Admin\AppData\Roaming\Download\379513.exe
                      "C:\Users\Admin\AppData\Roaming\Download\379513.exe"
                      5⤵
                        PID:4576
                    • C:\Users\Admin\AppData\Roaming\Download\392879.exe
                      "C:\Users\Admin\AppData\Roaming\Download\392879.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:5964
                      • C:\Users\Admin\AppData\Roaming\Download\392879.exe
                        "C:\Users\Admin\AppData\Roaming\Download\392879.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5020
                    • C:\Users\Admin\AppData\Roaming\Download\546935.exe
                      "C:\Users\Admin\AppData\Roaming\Download\546935.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:1856
                      • C:\Users\Admin\AppData\Roaming\Download\546935.exe
                        "C:\Users\Admin\AppData\Roaming\Download\546935.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5052
                    • C:\Users\Admin\AppData\Roaming\Download\180341.exe
                      "C:\Users\Admin\AppData\Roaming\Download\180341.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:3696
                      • C:\Users\Admin\AppData\Roaming\Download\180341.exe
                        "C:\Users\Admin\AppData\Roaming\Download\180341.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5532
                    • C:\Users\Admin\AppData\Roaming\Download\091891.exe
                      "C:\Users\Admin\AppData\Roaming\Download\091891.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:5380
                      • C:\Users\Admin\AppData\Roaming\Download\091891.exe
                        "C:\Users\Admin\AppData\Roaming\Download\091891.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4916
                    • C:\Users\Admin\AppData\Roaming\Download\558689.exe
                      "C:\Users\Admin\AppData\Roaming\Download\558689.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4512
                      • C:\Users\Admin\AppData\Roaming\Download\558689.exe
                        "C:\Users\Admin\AppData\Roaming\Download\558689.exe"
                        5⤵
                          PID:2396
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                    2⤵
                    • Drops file in Program Files directory
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:3944
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffcf461c188,0x7ffcf461c194,0x7ffcf461c1a0
                      3⤵
                        PID:3504
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,14531166585197137984,16267734599139020421,262144 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:2
                        3⤵
                          PID:1440
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,11878610015877584547,7698797172197487389,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:3
                          3⤵
                          • System Time Discovery
                          PID:1780
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,11547419920817052322,1513173053549744905,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
                          3⤵
                            PID:3320
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3064,i,762776300726282113,9364812613442032491,2097152 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
                            3⤵
                              PID:836
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3068,i,13790141334506826704,16978946827242873096,2097152 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
                              3⤵
                                PID:1976
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3364,i,17616258702189843774,9370394736802545032,2097152 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
                                3⤵
                                  PID:4840
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3380,i,2313621682645285400,3499830053682778218,2097152 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
                                  3⤵
                                    PID:4824
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6292977521032415754,12674447110987009443,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
                                    3⤵
                                      PID:2492
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,13870861322344329536,1082458754290994310,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
                                      3⤵
                                        PID:744
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5144,i,11979901677067994013,6066182235551186447,2097152 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
                                        3⤵
                                          PID:2852
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,14774294834887411848,8489157003661722262,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
                                          3⤵
                                            PID:4788
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11876171117166434016,15024483567182731117,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
                                            3⤵
                                              PID:4596
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9520410405182518394,7871074757514168000,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
                                              3⤵
                                                PID:2400
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9520410405182518394,7871074757514168000,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
                                                3⤵
                                                  PID:996
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,17734159868621118782,2881424704335798399,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
                                                  3⤵
                                                    PID:5336
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,12871420258939960810,5078576109757446968,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
                                                    3⤵
                                                      PID:5344
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,11158778972476883226,5843498728749287603,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
                                                      3⤵
                                                        PID:5784
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5330715664849025680,4291042039951517269,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
                                                        3⤵
                                                          PID:5856
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,18063393665027631672,8761071489871156262,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
                                                          3⤵
                                                            PID:5192
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,12349081207152118046,9699950916651355876,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
                                                            3⤵
                                                            • Modifies registry class
                                                            PID:5636
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,4157988659674092145,12981611129173013906,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
                                                            3⤵
                                                              PID:5644
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6608,i,568281452090305945,15375602991448596287,2097152 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
                                                              3⤵
                                                                PID:5388
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,17255070919579684553,14544819919068005677,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
                                                                3⤵
                                                                  PID:6064
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,12202734025966240456,10892572630845727417,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
                                                                  3⤵
                                                                    PID:5964
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,1023620917724218039,2947823127576561318,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
                                                                    3⤵
                                                                      PID:6040
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17598374479006651223,15579518910670418264,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
                                                                      3⤵
                                                                        PID:5452
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,15860517712752297689,2752230546973528236,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
                                                                        3⤵
                                                                          PID:1068
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7068234369448505521,10524933098619297582,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
                                                                          3⤵
                                                                            PID:3384
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,16703998693168769425,17313794370570954321,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
                                                                            3⤵
                                                                              PID:1224
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,8141468527920224617,3944818405844800579,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
                                                                              3⤵
                                                                                PID:5152
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,17983634715969110841,4674741955070433299,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
                                                                                3⤵
                                                                                  PID:5456
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7136,i,14467639888821166742,11748585030189109190,262144 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=852 /prefetch:8
                                                                                  3⤵
                                                                                    PID:540
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,3831265917366803214,12521629402002789013,524288 --field-trial-handle=4068,i,10326286777735997265,3193109705102567711,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:8
                                                                                    3⤵
                                                                                      PID:5232
                                                                                  • C:\Windows\explorer.exe
                                                                                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                    2⤵
                                                                                      PID:216
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                    1⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3684
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                      2⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:3928
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:4464

                                                                                    Network

                                                                                          MITRE ATT&CK Enterprise v16

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          DouTuDaShi.exe
                                                                                          • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                          • Size 1.1MB
                                                                                          • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1105119364\manifest.json
                                                                                          • Size 165B
                                                                                          • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1391091117\manifest.json
                                                                                          • Size 135B
                                                                                          • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1633394198\manifest.json
                                                                                          • Size 43B
                                                                                          • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_561854182\manifest.json
                                                                                          • Size 160B
                                                                                          • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          protocols.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                          • Size 3KB
                                                                                          • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          LOG.old
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                          • Size 334B
                                                                                          • SHA256 660b8c786e41e1ac41db25568b08b773af5d14ef153e22821848b25890112082
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          BookmarkMergedSurfaceOrdering
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                          • Size 6B
                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          96f9b4f9adf74a24_0
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                          • Size 213B
                                                                                          • SHA256 3aa4abb2b79257a95c65b1645e3e623679ff043fa530bbc2236ac95276d3cc05
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          df36dda3fc61f9c6_0
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df36dda3fc61f9c6_0
                                                                                          • Size 219B
                                                                                          • SHA256 ef219d70b7e18ae1854b868341622abaf7b2224220a53e7076fe1450fb744c1c
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 70220481d9ffeca38282063de0a9d79ef23c2fba575d88d55734701f5f2a7b6e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index~RFe58f9dc.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f9dc.TMP
                                                                                          • Size 3KB
                                                                                          • SHA256 216a33739b9e282806fff5a6fa4dcfd4d6aa986b70b5feb3a882732c894a942c
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          SiteList-Enterprise.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                          • Size 2B
                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Edge Profile.ico
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                          • Size 70KB
                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 6KB
                                                                                          • SHA256 b3995e778bb74383dc559e3e34d2699f2758d8840f127f998d06228b2a843214
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 111B
                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          SCT Auditing Pending Reports
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                          • Size 2B
                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 14KB
                                                                                          • SHA256 470c044dc6603ed47d7f4e8b0b7c10a763fa4706af587faad350518d51d82016
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 14KB
                                                                                          • SHA256 0fbd436282dbb0da9ff6998d0a9905f9fbfb7b5dfb206fa27c277b3667451fbf
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Secure Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                          • Size 35KB
                                                                                          • SHA256 b895a7c9b49df952a55eb8cdc791d26dfcf5b4d668fbe9cef8a96ff209af50d7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          sync_diagnostic.log
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                          • Size 5KB
                                                                                          • SHA256 e793788d71cb7f0b16589c3520d87ed055e655d40fa77d1666673c27c2999b5e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          ddc1f129-2811-4a33-b2f3-2341dd9ad1ea.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ddc1f129-2811-4a33-b2f3-2341dd9ad1ea.tmp
                                                                                          • Size 22KB
                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          office_endpoints_list.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                          • Size 9KB
                                                                                          • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 18KB
                                                                                          • SHA256 679437326d34b3440c06f31bb777d72a500615f909c14b6785b3b1fa24854304
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 29KB
                                                                                          • SHA256 950f3cee289117c8278b12aa2c2d0bcee1393d1f922ec491147605df5913cf68
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 9b50385a1505b1e1da5691e1df40272f2609a33704f00252dee781f349cbd2e4
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 52d3deba0f2767b4757c0e92880e9b62a7b90bd009f142e4e2fbc2fa457b1924
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 18KB
                                                                                          • SHA256 bc50a3c5f5aa33d6de4c09f15dbd80e60e1808bf73423755d54f1144e9cd9127
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          nav_config.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                          • Size 2KB
                                                                                          • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 252B
                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 132B
                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 372B
                                                                                          • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                          • Size 13B
                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Size 2KB
                                                                                          • SHA256 5e3868d50acda321151c31f169c25e58b37cf37ba2ec291325ea01e65bd10894
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          25d73e87-e2e8-4247-8ecc-b02a73cf65b5.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\25d73e87-e2e8-4247-8ecc-b02a73cf65b5.tmp
                                                                                          • Size 1B
                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          26118af5-3f8c-4164-861b-74f7c4e3fbd9.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\26118af5-3f8c-4164-861b-74f7c4e3fbd9.tmp
                                                                                          • Size 154KB
                                                                                          • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          eklzet.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eklzet.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 074a922ef53d5b36ef1564f69b2ebae4f13a9b39e6bb24f3988dabbc8d4ad536
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          ldsajdklsajdlkjsalkda.bat
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                          • Size 589B
                                                                                          • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          82d1ca54-575d-422e-b2bd-4c20031ac8c4.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3944_368183550\82d1ca54-575d-422e-b2bd-4c20031ac8c4.tmp
                                                                                          • Size 10KB
                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          content_new.js
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3944_368183550\CRX_INSTALL\content_new.js
                                                                                          • Size 10KB
                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          068006.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\068006.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 8452adf28aa74debce6b698d2028ba609e49e9d6ef4806bf202ad15a0b6a6a96
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          092581.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\092581.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 27d1064c64536e6b774763a5f52dd182524b866977b107f613292a80712a8c6d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          140275.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\140275.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 758487c9a4e793d0baa595b1d4e0d1e020aa514b558d2031434e6757a3ca453d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          173982.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\173982.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 d60440acb092d78c93187eedd457239e772e06f89da516b9efba4744e69f35cd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          182441.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\182441.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 77348e8a82de9bdaeb309d647fb3f03a1db8c92f7dda47466e457d27aa31c10c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          336245.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\336245.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 50bd96f8db0e6b1d428323d008fa3cdd51ff234bae4811713d89a9b5129d3292
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          455096.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\455096.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 eb4a793823cde8333469ced33ab003aab6da1f5b1ef9fbcd4453746d98dac0a7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          456167.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\456167.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 80b48d1e62f357098a3719723cb5ce87c60553d38e29ce19251757167b0c5980
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          489503.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\489503.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 3dde7945f14a89bd9a30f2ef50822028086e29efd50cb2f7cbcd11eaf8355e10
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          630102.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\630102.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 5a4aba5facc2e511dbeeed5e91186d9f73dba7a12d395778f472a8fbb59b279a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          752468.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\752468.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 859f6463f8ca6ef53b2b0bbbd9069dfa396b952dd7bf9ccbf3b6fdbc1e1f413a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          840793.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\840793.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 5307ae77d2856aebea7d24e628d1855e6e5122e10f5b72d10d54a4b295bd5d27
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          memory/388-794-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/388-430-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/388-1332-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/388-731-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/388-851-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4376-144-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download