Overview

overview

7

Static

static

3

2026-09-19...op.exe

windows10-2004-x64

7

2026-09-19...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/09/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-19_768e808266c12a1fae2ff6eb6ddab5b3_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260919-vb2fdayy3l
  • SHA256 2350d866a7d3fac2169e49979f69c3f6c6cba7bc1158f48282e1f5f8d0eee200
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 52 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_768e808266c12a1fae2ff6eb6ddab5b3_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-19_768e808266c12a1fae2ff6eb6ddab5b3_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4224
    • C:\Users\Admin\AppData\Local\Temp\aullbe.exe
      "C:\Users\Admin\AppData\Local\Temp\aullbe.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Users\Admin\AppData\Local\Temp\aullbe.exe
        "C:\Users\Admin\AppData\Local\Temp\aullbe.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Users\Admin\AppData\Roaming\Download\541198.exe
          "C:\Users\Admin\AppData\Roaming\Download\541198.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2912
          • C:\Users\Admin\AppData\Roaming\Download\541198.exe
            "C:\Users\Admin\AppData\Roaming\Download\541198.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1624
        • C:\Users\Admin\AppData\Roaming\Download\261440.exe
          "C:\Users\Admin\AppData\Roaming\Download\261440.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3432
          • C:\Users\Admin\AppData\Roaming\Download\261440.exe
            "C:\Users\Admin\AppData\Roaming\Download\261440.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2076
        • C:\Users\Admin\AppData\Roaming\Download\484506.exe
          "C:\Users\Admin\AppData\Roaming\Download\484506.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3648
          • C:\Users\Admin\AppData\Roaming\Download\484506.exe
            "C:\Users\Admin\AppData\Roaming\Download\484506.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1444
        • C:\Users\Admin\AppData\Roaming\Download\140878.exe
          "C:\Users\Admin\AppData\Roaming\Download\140878.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5848
          • C:\Users\Admin\AppData\Roaming\Download\140878.exe
            "C:\Users\Admin\AppData\Roaming\Download\140878.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5188
        • C:\Users\Admin\AppData\Roaming\Download\273134.exe
          "C:\Users\Admin\AppData\Roaming\Download\273134.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1824
          • C:\Users\Admin\AppData\Roaming\Download\273134.exe
            "C:\Users\Admin\AppData\Roaming\Download\273134.exe"
            5⤵
            • Executes dropped EXE
            PID:5920
        • C:\Users\Admin\AppData\Roaming\Download\319017.exe
          "C:\Users\Admin\AppData\Roaming\Download\319017.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5256
          • C:\Users\Admin\AppData\Roaming\Download\319017.exe
            "C:\Users\Admin\AppData\Roaming\Download\319017.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5332
        • C:\Users\Admin\AppData\Roaming\Download\543373.exe
          "C:\Users\Admin\AppData\Roaming\Download\543373.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5840
          • C:\Users\Admin\AppData\Roaming\Download\543373.exe
            "C:\Users\Admin\AppData\Roaming\Download\543373.exe"
            5⤵
            • Executes dropped EXE
            PID:3088
        • C:\Users\Admin\AppData\Roaming\Download\470633.exe
          "C:\Users\Admin\AppData\Roaming\Download\470633.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5320
          • C:\Users\Admin\AppData\Roaming\Download\470633.exe
            "C:\Users\Admin\AppData\Roaming\Download\470633.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5380
        • C:\Users\Admin\AppData\Roaming\Download\972264.exe
          "C:\Users\Admin\AppData\Roaming\Download\972264.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5536
          • C:\Users\Admin\AppData\Roaming\Download\972264.exe
            "C:\Users\Admin\AppData\Roaming\Download\972264.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3756
        • C:\Users\Admin\AppData\Roaming\Download\308324.exe
          "C:\Users\Admin\AppData\Roaming\Download\308324.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3972
          • C:\Users\Admin\AppData\Roaming\Download\308324.exe
            "C:\Users\Admin\AppData\Roaming\Download\308324.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1732
        • C:\Users\Admin\AppData\Roaming\Download\453307.exe
          "C:\Users\Admin\AppData\Roaming\Download\453307.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2204
          • C:\Users\Admin\AppData\Roaming\Download\453307.exe
            "C:\Users\Admin\AppData\Roaming\Download\453307.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6124
        • C:\Users\Admin\AppData\Roaming\Download\741105.exe
          "C:\Users\Admin\AppData\Roaming\Download\741105.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5396
          • C:\Users\Admin\AppData\Roaming\Download\741105.exe
            "C:\Users\Admin\AppData\Roaming\Download\741105.exe"
            5⤵
            • Executes dropped EXE
            PID:2108
        • C:\Users\Admin\AppData\Roaming\Download\963481.exe
          "C:\Users\Admin\AppData\Roaming\Download\963481.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2616
          • C:\Users\Admin\AppData\Roaming\Download\963481.exe
            "C:\Users\Admin\AppData\Roaming\Download\963481.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3652
        • C:\Users\Admin\AppData\Roaming\Download\019443.exe
          "C:\Users\Admin\AppData\Roaming\Download\019443.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5756
          • C:\Users\Admin\AppData\Roaming\Download\019443.exe
            "C:\Users\Admin\AppData\Roaming\Download\019443.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5836
        • C:\Users\Admin\AppData\Roaming\Download\247326.exe
          "C:\Users\Admin\AppData\Roaming\Download\247326.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1648
          • C:\Users\Admin\AppData\Roaming\Download\247326.exe
            "C:\Users\Admin\AppData\Roaming\Download\247326.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4020
        • C:\Users\Admin\AppData\Roaming\Download\348877.exe
          "C:\Users\Admin\AppData\Roaming\Download\348877.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2008
          • C:\Users\Admin\AppData\Roaming\Download\348877.exe
            "C:\Users\Admin\AppData\Roaming\Download\348877.exe"
            5⤵
            • Executes dropped EXE
            PID:2648
        • C:\Users\Admin\AppData\Roaming\Download\401977.exe
          "C:\Users\Admin\AppData\Roaming\Download\401977.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6108
          • C:\Users\Admin\AppData\Roaming\Download\401977.exe
            "C:\Users\Admin\AppData\Roaming\Download\401977.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6084
        • C:\Users\Admin\AppData\Roaming\Download\312208.exe
          "C:\Users\Admin\AppData\Roaming\Download\312208.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5384
          • C:\Users\Admin\AppData\Roaming\Download\312208.exe
            "C:\Users\Admin\AppData\Roaming\Download\312208.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:316
        • C:\Users\Admin\AppData\Roaming\Download\680216.exe
          "C:\Users\Admin\AppData\Roaming\Download\680216.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:804
          • C:\Users\Admin\AppData\Roaming\Download\680216.exe
            "C:\Users\Admin\AppData\Roaming\Download\680216.exe"
            5⤵
            • Executes dropped EXE
            PID:1000
        • C:\Users\Admin\AppData\Roaming\Download\677642.exe
          "C:\Users\Admin\AppData\Roaming\Download\677642.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5564
          • C:\Users\Admin\AppData\Roaming\Download\677642.exe
            "C:\Users\Admin\AppData\Roaming\Download\677642.exe"
            5⤵
            • Executes dropped EXE
            PID:6088
        • C:\Users\Admin\AppData\Roaming\Download\602908.exe
          "C:\Users\Admin\AppData\Roaming\Download\602908.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3348
          • C:\Users\Admin\AppData\Roaming\Download\602908.exe
            "C:\Users\Admin\AppData\Roaming\Download\602908.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5452
        • C:\Users\Admin\AppData\Roaming\Download\583359.exe
          "C:\Users\Admin\AppData\Roaming\Download\583359.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2404
          • C:\Users\Admin\AppData\Roaming\Download\583359.exe
            "C:\Users\Admin\AppData\Roaming\Download\583359.exe"
            5⤵
            • Executes dropped EXE
            PID:4320
        • C:\Users\Admin\AppData\Roaming\Download\070157.exe
          "C:\Users\Admin\AppData\Roaming\Download\070157.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3944
          • C:\Users\Admin\AppData\Roaming\Download\070157.exe
            "C:\Users\Admin\AppData\Roaming\Download\070157.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3516
        • C:\Users\Admin\AppData\Roaming\Download\012213.exe
          "C:\Users\Admin\AppData\Roaming\Download\012213.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6104
          • C:\Users\Admin\AppData\Roaming\Download\012213.exe
            "C:\Users\Admin\AppData\Roaming\Download\012213.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5072
        • C:\Users\Admin\AppData\Roaming\Download\890847.exe
          "C:\Users\Admin\AppData\Roaming\Download\890847.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6084
          • C:\Users\Admin\AppData\Roaming\Download\890847.exe
            "C:\Users\Admin\AppData\Roaming\Download\890847.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6088
        • C:\Users\Admin\AppData\Roaming\Download\973398.exe
          "C:\Users\Admin\AppData\Roaming\Download\973398.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2080
          • C:\Users\Admin\AppData\Roaming\Download\973398.exe
            "C:\Users\Admin\AppData\Roaming\Download\973398.exe"
            5⤵
            • Executes dropped EXE
            PID:5452
        • C:\Users\Admin\AppData\Roaming\Download\268185.exe
          "C:\Users\Admin\AppData\Roaming\Download\268185.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5392
          • C:\Users\Admin\AppData\Roaming\Download\268185.exe
            "C:\Users\Admin\AppData\Roaming\Download\268185.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5820
        • C:\Users\Admin\AppData\Roaming\Download\141636.exe
          "C:\Users\Admin\AppData\Roaming\Download\141636.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5548
          • C:\Users\Admin\AppData\Roaming\Download\141636.exe
            "C:\Users\Admin\AppData\Roaming\Download\141636.exe"
            5⤵
            • Executes dropped EXE
            PID:5000
        • C:\Users\Admin\AppData\Roaming\Download\384792.exe
          "C:\Users\Admin\AppData\Roaming\Download\384792.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3516
          • C:\Users\Admin\AppData\Roaming\Download\384792.exe
            "C:\Users\Admin\AppData\Roaming\Download\384792.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4508
        • C:\Users\Admin\AppData\Roaming\Download\316068.exe
          "C:\Users\Admin\AppData\Roaming\Download\316068.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5876
          • C:\Users\Admin\AppData\Roaming\Download\316068.exe
            "C:\Users\Admin\AppData\Roaming\Download\316068.exe"
            5⤵
            • Executes dropped EXE
            PID:6124
        • C:\Users\Admin\AppData\Roaming\Download\359124.exe
          "C:\Users\Admin\AppData\Roaming\Download\359124.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5228
          • C:\Users\Admin\AppData\Roaming\Download\359124.exe
            "C:\Users\Admin\AppData\Roaming\Download\359124.exe"
            5⤵
              PID:4864
          • C:\Users\Admin\AppData\Roaming\Download\584206.exe
            "C:\Users\Admin\AppData\Roaming\Download\584206.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:5304
            • C:\Users\Admin\AppData\Roaming\Download\584206.exe
              "C:\Users\Admin\AppData\Roaming\Download\584206.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5896
          • C:\Users\Admin\AppData\Roaming\Download\972094.exe
            "C:\Users\Admin\AppData\Roaming\Download\972094.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:5920
            • C:\Users\Admin\AppData\Roaming\Download\972094.exe
              "C:\Users\Admin\AppData\Roaming\Download\972094.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3136
          • C:\Users\Admin\AppData\Roaming\Download\953545.exe
            "C:\Users\Admin\AppData\Roaming\Download\953545.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:4060
            • C:\Users\Admin\AppData\Roaming\Download\953545.exe
              "C:\Users\Admin\AppData\Roaming\Download\953545.exe"
              5⤵
                PID:652
            • C:\Users\Admin\AppData\Roaming\Download\752171.exe
              "C:\Users\Admin\AppData\Roaming\Download\752171.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:2620
              • C:\Users\Admin\AppData\Roaming\Download\752171.exe
                "C:\Users\Admin\AppData\Roaming\Download\752171.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1108
            • C:\Users\Admin\AppData\Roaming\Download\975237.exe
              "C:\Users\Admin\AppData\Roaming\Download\975237.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:4116
              • C:\Users\Admin\AppData\Roaming\Download\975237.exe
                "C:\Users\Admin\AppData\Roaming\Download\975237.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5352
            • C:\Users\Admin\AppData\Roaming\Download\917503.exe
              "C:\Users\Admin\AppData\Roaming\Download\917503.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:2228
              • C:\Users\Admin\AppData\Roaming\Download\917503.exe
                "C:\Users\Admin\AppData\Roaming\Download\917503.exe"
                5⤵
                  PID:4684
              • C:\Users\Admin\AppData\Roaming\Download\043486.exe
                "C:\Users\Admin\AppData\Roaming\Download\043486.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:316
                • C:\Users\Admin\AppData\Roaming\Download\043486.exe
                  "C:\Users\Admin\AppData\Roaming\Download\043486.exe"
                  5⤵
                    PID:5264
                • C:\Users\Admin\AppData\Roaming\Download\113463.exe
                  "C:\Users\Admin\AppData\Roaming\Download\113463.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  PID:5668
                  • C:\Users\Admin\AppData\Roaming\Download\113463.exe
                    "C:\Users\Admin\AppData\Roaming\Download\113463.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4772
                • C:\Users\Admin\AppData\Roaming\Download\135629.exe
                  "C:\Users\Admin\AppData\Roaming\Download\135629.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:616
                  • C:\Users\Admin\AppData\Roaming\Download\135629.exe
                    "C:\Users\Admin\AppData\Roaming\Download\135629.exe"
                    5⤵
                      PID:6096
                  • C:\Users\Admin\AppData\Roaming\Download\180985.exe
                    "C:\Users\Admin\AppData\Roaming\Download\180985.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:2780
                    • C:\Users\Admin\AppData\Roaming\Download\180985.exe
                      "C:\Users\Admin\AppData\Roaming\Download\180985.exe"
                      5⤵
                        PID:3208
                    • C:\Users\Admin\AppData\Roaming\Download\261235.exe
                      "C:\Users\Admin\AppData\Roaming\Download\261235.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:3404
                      • C:\Users\Admin\AppData\Roaming\Download\261235.exe
                        "C:\Users\Admin\AppData\Roaming\Download\261235.exe"
                        5⤵
                          PID:4744
                      • C:\Users\Admin\AppData\Roaming\Download\383591.exe
                        "C:\Users\Admin\AppData\Roaming\Download\383591.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:1444
                        • C:\Users\Admin\AppData\Roaming\Download\383591.exe
                          "C:\Users\Admin\AppData\Roaming\Download\383591.exe"
                          5⤵
                            PID:5908
                        • C:\Users\Admin\AppData\Roaming\Download\570399.exe
                          "C:\Users\Admin\AppData\Roaming\Download\570399.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:2104
                          • C:\Users\Admin\AppData\Roaming\Download\570399.exe
                            "C:\Users\Admin\AppData\Roaming\Download\570399.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:3912
                        • C:\Users\Admin\AppData\Roaming\Download\452840.exe
                          "C:\Users\Admin\AppData\Roaming\Download\452840.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          PID:2376
                          • C:\Users\Admin\AppData\Roaming\Download\452840.exe
                            "C:\Users\Admin\AppData\Roaming\Download\452840.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:3748
                        • C:\Users\Admin\AppData\Roaming\Download\845711.exe
                          "C:\Users\Admin\AppData\Roaming\Download\845711.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:4488
                          • C:\Users\Admin\AppData\Roaming\Download\845711.exe
                            "C:\Users\Admin\AppData\Roaming\Download\845711.exe"
                            5⤵
                              PID:2788
                          • C:\Users\Admin\AppData\Roaming\Download\615347.exe
                            "C:\Users\Admin\AppData\Roaming\Download\615347.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            PID:5652
                            • C:\Users\Admin\AppData\Roaming\Download\615347.exe
                              "C:\Users\Admin\AppData\Roaming\Download\615347.exe"
                              5⤵
                                PID:4164
                            • C:\Users\Admin\AppData\Roaming\Download\668633.exe
                              "C:\Users\Admin\AppData\Roaming\Download\668633.exe" /Shorttailedrestart
                              4⤵
                              • Checks computer location settings
                              • System Location Discovery: System Language Discovery
                              PID:1160
                              • C:\Users\Admin\AppData\Roaming\Download\668633.exe
                                "C:\Users\Admin\AppData\Roaming\Download\668633.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:5648
                            • C:\Users\Admin\AppData\Roaming\Download\635067.exe
                              "C:\Users\Admin\AppData\Roaming\Download\635067.exe" /Shorttailedrestart
                              4⤵
                              • Checks computer location settings
                              • System Location Discovery: System Language Discovery
                              PID:6128
                              • C:\Users\Admin\AppData\Roaming\Download\635067.exe
                                "C:\Users\Admin\AppData\Roaming\Download\635067.exe"
                                5⤵
                                  PID:908
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                            2⤵
                            • Drops file in Program Files directory
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of WriteProcessMemory
                            PID:1788
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffac443c188,0x7ffac443c194,0x7ffac443c1a0
                              3⤵
                                PID:1264
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7836161718136398666,17620886046816954040,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
                                3⤵
                                • System Time Discovery
                                PID:5028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,13842528892589213806,1010830170254843823,262144 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
                                3⤵
                                  PID:3476
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,9179153369021234368,17758339661493426214,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
                                  3⤵
                                    PID:4280
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,5255970989799517744,5992240732381423116,2097152 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                                    3⤵
                                      PID:1824
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,3768029719298291009,7529872274676915169,2097152 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
                                      3⤵
                                        PID:428
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,16274617267127219747,12854403509980953661,2097152 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
                                        3⤵
                                          PID:1140
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9475766958400804119,2743825586532447479,2097152 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
                                          3⤵
                                            PID:652
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,15035467581881362794,15180793342685720334,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
                                            3⤵
                                              PID:1560
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4816681976067476542,6836348678001727897,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
                                              3⤵
                                                PID:1848
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16460716370057790783,7362049342655166065,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
                                                3⤵
                                                  PID:4748
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16993878244838697614,5412545531868673397,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
                                                  3⤵
                                                    PID:1508
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16993878244838697614,5412545531868673397,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
                                                    3⤵
                                                      PID:752
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2722970650803125916,1808630279983700956,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
                                                      3⤵
                                                        PID:4140
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9662741949378637224,8582884658414134855,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
                                                        3⤵
                                                          PID:2020
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,12800580052358061449,14216758881604560545,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
                                                          3⤵
                                                            PID:4152
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9975581180882788742,3426979815337559336,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
                                                            3⤵
                                                              PID:4776
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10958766204524977297,13050826587283205119,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
                                                              3⤵
                                                                PID:5636
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6652,i,786856618359846407,8743618089009190333,2097152 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
                                                                3⤵
                                                                  PID:5788
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10670942328046836375,12446079974752587002,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
                                                                  3⤵
                                                                    PID:5124
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17933221883052792953,6887983128362799571,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
                                                                    3⤵
                                                                    • Modifies registry class
                                                                    PID:5904
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3736,i,950209198457503111,15004506348883323209,2097152 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
                                                                    3⤵
                                                                      PID:5416
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,4343827135785375764,10164698006487740463,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
                                                                      3⤵
                                                                        PID:6088
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16843666674249619101,16898161343713318087,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
                                                                        3⤵
                                                                          PID:6100
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,767716845640050735,9610637897238645177,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
                                                                          3⤵
                                                                            PID:5208
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,10378724764289291605,11814707066825211885,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
                                                                            3⤵
                                                                              PID:4108
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3565772638910254711,15471791993885912577,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
                                                                              3⤵
                                                                                PID:1564
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,13124343075148169578,466507529193329625,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
                                                                                3⤵
                                                                                  PID:5360
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7369764775298840506,10512239311308576333,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
                                                                                  3⤵
                                                                                    PID:4588
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5656,i,9976530850076626754,5868445755986717838,262144 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
                                                                                    3⤵
                                                                                      PID:6136
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,7009220043402513203,14578429245215818947,524288 --field-trial-handle=2140,i,4940491604628871672,7298249994043465368,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
                                                                                      3⤵
                                                                                        PID:4596
                                                                                    • C:\Windows\explorer.exe
                                                                                      "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                      2⤵
                                                                                        PID:804
                                                                                    • C:\Windows\explorer.exe
                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                      1⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3352
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                        2⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:2004
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:5104
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                        1⤵
                                                                                          PID:5748

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v16

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              DouTuDaShi.exe
                                                                                              • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                              • Size 1.1MB
                                                                                              • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              manifest.json
                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1541596981\manifest.json
                                                                                              • Size 43B
                                                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              manifest.json
                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1663866979\manifest.json
                                                                                              • Size 165B
                                                                                              • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              manifest.json
                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1913580460\manifest.json
                                                                                              • Size 135B
                                                                                              • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              manifest.json
                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_538578114\manifest.json
                                                                                              • Size 160B
                                                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              protocols.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                              • Size 3KB
                                                                                              • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              settings.dat
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                              • Size 280B
                                                                                              • SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              settings.dat
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                              • Size 280B
                                                                                              • SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              BookmarkMergedSurfaceOrdering
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                              • Size 6B
                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              f_000087
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
                                                                                              • Size 1024KB
                                                                                              • SHA256 ef661f906afcafa9dae138f484f481725534460b160b30b758f5a71ef37b6d2c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              96f9b4f9adf74a24_0
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                              • Size 213B
                                                                                              • SHA256 ca63bd17ae50ab760a3840ee454197fc358c994b063b3bc36727a55acab7f964
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              a778f3c2e962d2a7_0
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a778f3c2e962d2a7_0
                                                                                              • Size 223B
                                                                                              • SHA256 82fdc7a66e696713fd8f342b91189abd24f31cda7c79cfd06a7a702307e95f85
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              the-real-index
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                              • Size 4KB
                                                                                              • SHA256 998cd50a70cc864d10a783c10c7e952e45d37efacd56c0579e866845261435cb
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              the-real-index~RFe5969ad.TMP
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5969ad.TMP
                                                                                              • Size 3KB
                                                                                              • SHA256 d53ec0f8d0498953d9835ef12847d0f6eb5440c746caa8c386c42672b453e2c4
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              SiteList-Enterprise.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                              • Size 2B
                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              Edge Profile.ico
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                              • Size 70KB
                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Network Persistent State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                              • Size 111B
                                                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              Network Persistent State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                              • Size 5KB
                                                                                              • SHA256 e41fd0f351cbf9e4a9a853beece6f3973fec97785da6ba69541a8aa367107d63
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SCT Auditing Pending Reports
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                              • Size 2B
                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              Preferences
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              • Size 11KB
                                                                                              • SHA256 5f924b8e98a41efcfd18d86da21416c329d2efe118440cdd0964d5776cff67fa
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Preferences
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              • Size 11KB
                                                                                              • SHA256 47736da64a5fe206c1c7bb0f76456ca2f763162e161f7db09c0e039b04995fff
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Preferences
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              • Size 11KB
                                                                                              • SHA256 9f67a32ced94e9f3ca6794e3d3e8ba1e50dd4b8f60119bc1a63c861475ae043c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Secure Preferences
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                              • Size 32KB
                                                                                              • SHA256 bce723889e6de6f473592873ac56055b7bf1d5a537e2d75c46ca4f3ddf3c969d
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              sync_diagnostic.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                              • Size 4KB
                                                                                              • SHA256 4d2a02ec52f4437df009501e036f5134a53a98d20090868277c54d8ca48bf8b8
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              OperationConfig
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                              • Size 22KB
                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              OperationConfig~RFe599a13.TMP
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599a13.TMP
                                                                                              • Size 3KB
                                                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              office_endpoints_list.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                              • Size 9KB
                                                                                              • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Local State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              • Size 8KB
                                                                                              • SHA256 03669a3436db0fb38d320face51371f1f33547e0fd03406fdbc68f539ff44aa1
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Local State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              • Size 18KB
                                                                                              • SHA256 cf8d6ab7a3f992058f5060e62754ddebde4b034c14f4f59af71368a5c3bda436
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Local State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              • Size 18KB
                                                                                              • SHA256 4aef2714bd576c0884e106680c79ab1694140a1bc55eee7221b0a49077b8894e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Local State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              • Size 28KB
                                                                                              • SHA256 21b05a3b56ab311b4a065544f0af56abb0a213d1c94e151c86777d9978a3f35b
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Local State
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              • Size 8KB
                                                                                              • SHA256 95359e389690d337436e51b1137200783f4f04450b81061b8735ec34371b89a4
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              nav_config.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                              • Size 2KB
                                                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              metadata.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                              • Size 252B
                                                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              metadata.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                              • Size 372B
                                                                                              • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              metadata.json
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                              • Size 132B
                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              1837ef59-cb28-4905-8f76-5974bfd65762.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1837ef59-cb28-4905-8f76-5974bfd65762.tmp
                                                                                              • Size 13B
                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                              • Size 2KB
                                                                                              • SHA256 38878ce41c3067ea947a07a90b10c4e5a0b78da5f2b1a48110a945faf3f50f8f
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              4bc84072-5c2f-441a-9597-7e0e4257839a.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\4bc84072-5c2f-441a-9597-7e0e4257839a.tmp
                                                                                              • Size 10KB
                                                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              aullbe.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\aullbe.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 2350d866a7d3fac2169e49979f69c3f6c6cba7bc1158f48282e1f5f8d0eee200
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              b00db387-860b-4176-ba77-38a66f967e9a.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b00db387-860b-4176-ba77-38a66f967e9a.tmp
                                                                                              • Size 1B
                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ldsajdklsajdlkjsalkda.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                              • Size 589B
                                                                                              • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              content_new.js
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1788_444321271\CRX_INSTALL\content_new.js
                                                                                              • Size 10KB
                                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              9c471f2b-3410-4683-b3ca-4f6206881246.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1788_818413013\9c471f2b-3410-4683-b3ca-4f6206881246.tmp
                                                                                              • Size 157KB
                                                                                              • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              140878.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\140878.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 a92b353d5e4973d4905de39c69829548f632aca9b00635d9c70006c345fe3b6d
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              261440.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\261440.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 e4dd050b5f9e18e94e665809b2aec2654b7b3e1801df2a5e8ec5b8ba699a7f1f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              273134.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\273134.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 fd170c166caad26fdc92a3dcfe598e76a85133acb708841e1431ef5ddbe2907a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              308324.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\308324.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 7119d76058048cc31bd773414a46a5113688030abd3c5a514ebecfeedb6f68ec
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              319017.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\319017.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 8b1288a997a59b2f78061ad2bfea8f2b40c4e5328bdcd4b16fb14b1cfe7ba642
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              453307.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\453307.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 6745192c758f4bf3e4574ef14865893dd030042b5bc3714ab8dad24ca40feabb
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              470633.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\470633.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 d9a2958aa62133c664616384b3e9d23ed5af2fe13b24697617284d42329023a4
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              484506.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\484506.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 50417bbf21382f90f5cf41e041c4aec109fce70db9a7211439adf4e138646953
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              541198.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\541198.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 0d67ae18a3994c22ebadcddb5a5b90d908dd622c4e6ddc6ea105e55be04112ec
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              543373.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\543373.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 fa18ceb1b256f414b1c82e6fbb7c6441f7f190b261d1e77e62cbe38d6efd1ed6
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              741105.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\741105.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 fea346a3641590900d28eb2137e139d6f57388fb47a4fc114ffd1871b4e38ea0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              963481.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\963481.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 bf392d7369a44d16dc43d4d4400eb068a274b09ab00097793fd24db7c0fd45f5
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              972264.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\972264.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 fc4e045ad67e282041f553f6743725f14437cf928a593ec24ba3a0bd9c710030
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              memory/368-240-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                              Download

                                                                                              memory/1400-525-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                              Download

                                                                                              memory/1400-1402-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                              Download

                                                                                              memory/1400-881-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                              Download