Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 01:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_484d8b2b0d7c23c2f113ec2c3f5933ef_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-ccrcpaybph
  • SHA256 7516097411561914601fc27f69dda0a8d1e6e6579734c07d2cca566b703ca4c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_484d8b2b0d7c23c2f113ec2c3f5933ef_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_484d8b2b0d7c23c2f113ec2c3f5933ef_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2272
    • C:\Users\Admin\AppData\Local\Temp\oxtjun.exe
      "C:\Users\Admin\AppData\Local\Temp\oxtjun.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\Temp\oxtjun.exe
        "C:\Users\Admin\AppData\Local\Temp\oxtjun.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Users\Admin\AppData\Roaming\Download\719301.exe
          "C:\Users\Admin\AppData\Roaming\Download\719301.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3844
          • C:\Users\Admin\AppData\Roaming\Download\719301.exe
            "C:\Users\Admin\AppData\Roaming\Download\719301.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4440
        • C:\Users\Admin\AppData\Roaming\Download\114871.exe
          "C:\Users\Admin\AppData\Roaming\Download\114871.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1096
          • C:\Users\Admin\AppData\Roaming\Download\114871.exe
            "C:\Users\Admin\AppData\Roaming\Download\114871.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4488
        • C:\Users\Admin\AppData\Roaming\Download\266381.exe
          "C:\Users\Admin\AppData\Roaming\Download\266381.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Users\Admin\AppData\Roaming\Download\266381.exe
            "C:\Users\Admin\AppData\Roaming\Download\266381.exe"
            5⤵
            • Executes dropped EXE
            PID:4488
        • C:\Users\Admin\AppData\Roaming\Download\446806.exe
          "C:\Users\Admin\AppData\Roaming\Download\446806.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5200
          • C:\Users\Admin\AppData\Roaming\Download\446806.exe
            "C:\Users\Admin\AppData\Roaming\Download\446806.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5432
        • C:\Users\Admin\AppData\Roaming\Download\819843.exe
          "C:\Users\Admin\AppData\Roaming\Download\819843.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6076
          • C:\Users\Admin\AppData\Roaming\Download\819843.exe
            "C:\Users\Admin\AppData\Roaming\Download\819843.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5316
        • C:\Users\Admin\AppData\Roaming\Download\829115.exe
          "C:\Users\Admin\AppData\Roaming\Download\829115.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5276
          • C:\Users\Admin\AppData\Roaming\Download\829115.exe
            "C:\Users\Admin\AppData\Roaming\Download\829115.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5744
        • C:\Users\Admin\AppData\Roaming\Download\228807.exe
          "C:\Users\Admin\AppData\Roaming\Download\228807.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4168
          • C:\Users\Admin\AppData\Roaming\Download\228807.exe
            "C:\Users\Admin\AppData\Roaming\Download\228807.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6124
        • C:\Users\Admin\AppData\Roaming\Download\379444.exe
          "C:\Users\Admin\AppData\Roaming\Download\379444.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2080
          • C:\Users\Admin\AppData\Roaming\Download\379444.exe
            "C:\Users\Admin\AppData\Roaming\Download\379444.exe"
            5⤵
            • Executes dropped EXE
            PID:4708
        • C:\Users\Admin\AppData\Roaming\Download\502700.exe
          "C:\Users\Admin\AppData\Roaming\Download\502700.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4628
          • C:\Users\Admin\AppData\Roaming\Download\502700.exe
            "C:\Users\Admin\AppData\Roaming\Download\502700.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5744
        • C:\Users\Admin\AppData\Roaming\Download\889507.exe
          "C:\Users\Admin\AppData\Roaming\Download\889507.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5008
          • C:\Users\Admin\AppData\Roaming\Download\889507.exe
            "C:\Users\Admin\AppData\Roaming\Download\889507.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5984
        • C:\Users\Admin\AppData\Roaming\Download\893665.exe
          "C:\Users\Admin\AppData\Roaming\Download\893665.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1704
          • C:\Users\Admin\AppData\Roaming\Download\893665.exe
            "C:\Users\Admin\AppData\Roaming\Download\893665.exe"
            5⤵
            • Executes dropped EXE
            PID:3932
        • C:\Users\Admin\AppData\Roaming\Download\160662.exe
          "C:\Users\Admin\AppData\Roaming\Download\160662.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5736
          • C:\Users\Admin\AppData\Roaming\Download\160662.exe
            "C:\Users\Admin\AppData\Roaming\Download\160662.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5896
        • C:\Users\Admin\AppData\Roaming\Download\416645.exe
          "C:\Users\Admin\AppData\Roaming\Download\416645.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5104
          • C:\Users\Admin\AppData\Roaming\Download\416645.exe
            "C:\Users\Admin\AppData\Roaming\Download\416645.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1156
        • C:\Users\Admin\AppData\Roaming\Download\397096.exe
          "C:\Users\Admin\AppData\Roaming\Download\397096.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5664
          • C:\Users\Admin\AppData\Roaming\Download\397096.exe
            "C:\Users\Admin\AppData\Roaming\Download\397096.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5784
        • C:\Users\Admin\AppData\Roaming\Download\798708.exe
          "C:\Users\Admin\AppData\Roaming\Download\798708.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5896
          • C:\Users\Admin\AppData\Roaming\Download\798708.exe
            "C:\Users\Admin\AppData\Roaming\Download\798708.exe"
            5⤵
            • Executes dropped EXE
            PID:5636
        • C:\Users\Admin\AppData\Roaming\Download\584662.exe
          "C:\Users\Admin\AppData\Roaming\Download\584662.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3336
          • C:\Users\Admin\AppData\Roaming\Download\584662.exe
            "C:\Users\Admin\AppData\Roaming\Download\584662.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1780
        • C:\Users\Admin\AppData\Roaming\Download\465013.exe
          "C:\Users\Admin\AppData\Roaming\Download\465013.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5304
          • C:\Users\Admin\AppData\Roaming\Download\465013.exe
            "C:\Users\Admin\AppData\Roaming\Download\465013.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4716
        • C:\Users\Admin\AppData\Roaming\Download\765725.exe
          "C:\Users\Admin\AppData\Roaming\Download\765725.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5472
          • C:\Users\Admin\AppData\Roaming\Download\765725.exe
            "C:\Users\Admin\AppData\Roaming\Download\765725.exe"
            5⤵
            • Executes dropped EXE
            PID:5872
        • C:\Users\Admin\AppData\Roaming\Download\356439.exe
          "C:\Users\Admin\AppData\Roaming\Download\356439.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5636
          • C:\Users\Admin\AppData\Roaming\Download\356439.exe
            "C:\Users\Admin\AppData\Roaming\Download\356439.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5916
        • C:\Users\Admin\AppData\Roaming\Download\603218.exe
          "C:\Users\Admin\AppData\Roaming\Download\603218.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4904
          • C:\Users\Admin\AppData\Roaming\Download\603218.exe
            "C:\Users\Admin\AppData\Roaming\Download\603218.exe"
            5⤵
            • Executes dropped EXE
            PID:2460
        • C:\Users\Admin\AppData\Roaming\Download\870016.exe
          "C:\Users\Admin\AppData\Roaming\Download\870016.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4688
          • C:\Users\Admin\AppData\Roaming\Download\870016.exe
            "C:\Users\Admin\AppData\Roaming\Download\870016.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5900
        • C:\Users\Admin\AppData\Roaming\Download\973557.exe
          "C:\Users\Admin\AppData\Roaming\Download\973557.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5776
          • C:\Users\Admin\AppData\Roaming\Download\973557.exe
            "C:\Users\Admin\AppData\Roaming\Download\973557.exe"
            5⤵
            • Executes dropped EXE
            PID:6108
        • C:\Users\Admin\AppData\Roaming\Download\248354.exe
          "C:\Users\Admin\AppData\Roaming\Download\248354.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4896
          • C:\Users\Admin\AppData\Roaming\Download\248354.exe
            "C:\Users\Admin\AppData\Roaming\Download\248354.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2344
        • C:\Users\Admin\AppData\Roaming\Download\151705.exe
          "C:\Users\Admin\AppData\Roaming\Download\151705.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2268
          • C:\Users\Admin\AppData\Roaming\Download\151705.exe
            "C:\Users\Admin\AppData\Roaming\Download\151705.exe"
            5⤵
            • Executes dropped EXE
            PID:5228
        • C:\Users\Admin\AppData\Roaming\Download\377788.exe
          "C:\Users\Admin\AppData\Roaming\Download\377788.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4336
          • C:\Users\Admin\AppData\Roaming\Download\377788.exe
            "C:\Users\Admin\AppData\Roaming\Download\377788.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4964
        • C:\Users\Admin\AppData\Roaming\Download\071217.exe
          "C:\Users\Admin\AppData\Roaming\Download\071217.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2396
          • C:\Users\Admin\AppData\Roaming\Download\071217.exe
            "C:\Users\Admin\AppData\Roaming\Download\071217.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5784
        • C:\Users\Admin\AppData\Roaming\Download\266004.exe
          "C:\Users\Admin\AppData\Roaming\Download\266004.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4572
          • C:\Users\Admin\AppData\Roaming\Download\266004.exe
            "C:\Users\Admin\AppData\Roaming\Download\266004.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6108
        • C:\Users\Admin\AppData\Roaming\Download\179555.exe
          "C:\Users\Admin\AppData\Roaming\Download\179555.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5404
          • C:\Users\Admin\AppData\Roaming\Download\179555.exe
            "C:\Users\Admin\AppData\Roaming\Download\179555.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4276
        • C:\Users\Admin\AppData\Roaming\Download\636353.exe
          "C:\Users\Admin\AppData\Roaming\Download\636353.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2460
          • C:\Users\Admin\AppData\Roaming\Download\636353.exe
            "C:\Users\Admin\AppData\Roaming\Download\636353.exe"
            5⤵
            • Executes dropped EXE
            PID:1860
        • C:\Users\Admin\AppData\Roaming\Download\688619.exe
          "C:\Users\Admin\AppData\Roaming\Download\688619.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4664
          • C:\Users\Admin\AppData\Roaming\Download\688619.exe
            "C:\Users\Admin\AppData\Roaming\Download\688619.exe"
            5⤵
            • Executes dropped EXE
            PID:968
        • C:\Users\Admin\AppData\Roaming\Download\601774.exe
          "C:\Users\Admin\AppData\Roaming\Download\601774.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4052
          • C:\Users\Admin\AppData\Roaming\Download\601774.exe
            "C:\Users\Admin\AppData\Roaming\Download\601774.exe"
            5⤵
              PID:2736
          • C:\Users\Admin\AppData\Roaming\Download\702225.exe
            "C:\Users\Admin\AppData\Roaming\Download\702225.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5628
            • C:\Users\Admin\AppData\Roaming\Download\702225.exe
              "C:\Users\Admin\AppData\Roaming\Download\702225.exe"
              5⤵
                PID:216
            • C:\Users\Admin\AppData\Roaming\Download\079013.exe
              "C:\Users\Admin\AppData\Roaming\Download\079013.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:2892
              • C:\Users\Admin\AppData\Roaming\Download\079013.exe
                "C:\Users\Admin\AppData\Roaming\Download\079013.exe"
                5⤵
                  PID:3232
              • C:\Users\Admin\AppData\Roaming\Download\970464.exe
                "C:\Users\Admin\AppData\Roaming\Download\970464.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:1512
                • C:\Users\Admin\AppData\Roaming\Download\970464.exe
                  "C:\Users\Admin\AppData\Roaming\Download\970464.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1256
              • C:\Users\Admin\AppData\Roaming\Download\103520.exe
                "C:\Users\Admin\AppData\Roaming\Download\103520.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:1780
                • C:\Users\Admin\AppData\Roaming\Download\103520.exe
                  "C:\Users\Admin\AppData\Roaming\Download\103520.exe"
                  5⤵
                    PID:4668
                • C:\Users\Admin\AppData\Roaming\Download\348712.exe
                  "C:\Users\Admin\AppData\Roaming\Download\348712.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:1552
                  • C:\Users\Admin\AppData\Roaming\Download\348712.exe
                    "C:\Users\Admin\AppData\Roaming\Download\348712.exe"
                    5⤵
                      PID:1636
                  • C:\Users\Admin\AppData\Roaming\Download\476795.exe
                    "C:\Users\Admin\AppData\Roaming\Download\476795.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:3036
                    • C:\Users\Admin\AppData\Roaming\Download\476795.exe
                      "C:\Users\Admin\AppData\Roaming\Download\476795.exe"
                      5⤵
                        PID:4844
                    • C:\Users\Admin\AppData\Roaming\Download\429051.exe
                      "C:\Users\Admin\AppData\Roaming\Download\429051.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:5748
                      • C:\Users\Admin\AppData\Roaming\Download\429051.exe
                        "C:\Users\Admin\AppData\Roaming\Download\429051.exe"
                        5⤵
                          PID:4164
                      • C:\Users\Admin\AppData\Roaming\Download\741017.exe
                        "C:\Users\Admin\AppData\Roaming\Download\741017.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:2984
                        • C:\Users\Admin\AppData\Roaming\Download\741017.exe
                          "C:\Users\Admin\AppData\Roaming\Download\741017.exe"
                          5⤵
                            PID:3108
                        • C:\Users\Admin\AppData\Roaming\Download\642568.exe
                          "C:\Users\Admin\AppData\Roaming\Download\642568.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:5900
                          • C:\Users\Admin\AppData\Roaming\Download\642568.exe
                            "C:\Users\Admin\AppData\Roaming\Download\642568.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:5188
                        • C:\Users\Admin\AppData\Roaming\Download\819355.exe
                          "C:\Users\Admin\AppData\Roaming\Download\819355.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:1308
                          • C:\Users\Admin\AppData\Roaming\Download\819355.exe
                            "C:\Users\Admin\AppData\Roaming\Download\819355.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4716
                        • C:\Users\Admin\AppData\Roaming\Download\910806.exe
                          "C:\Users\Admin\AppData\Roaming\Download\910806.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:5944
                          • C:\Users\Admin\AppData\Roaming\Download\910806.exe
                            "C:\Users\Admin\AppData\Roaming\Download\910806.exe"
                            5⤵
                              PID:4156
                          • C:\Users\Admin\AppData\Roaming\Download\452335.exe
                            "C:\Users\Admin\AppData\Roaming\Download\452335.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            PID:872
                            • C:\Users\Admin\AppData\Roaming\Download\452335.exe
                              "C:\Users\Admin\AppData\Roaming\Download\452335.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1716
                          • C:\Users\Admin\AppData\Roaming\Download\220960.exe
                            "C:\Users\Admin\AppData\Roaming\Download\220960.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            PID:3232
                            • C:\Users\Admin\AppData\Roaming\Download\220960.exe
                              "C:\Users\Admin\AppData\Roaming\Download\220960.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:5312
                          • C:\Users\Admin\AppData\Roaming\Download\452027.exe
                            "C:\Users\Admin\AppData\Roaming\Download\452027.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            PID:3812
                            • C:\Users\Admin\AppData\Roaming\Download\452027.exe
                              "C:\Users\Admin\AppData\Roaming\Download\452027.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:6120
                          • C:\Users\Admin\AppData\Roaming\Download\455478.exe
                            "C:\Users\Admin\AppData\Roaming\Download\455478.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            PID:1632
                            • C:\Users\Admin\AppData\Roaming\Download\455478.exe
                              "C:\Users\Admin\AppData\Roaming\Download\455478.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1824
                          • C:\Users\Admin\AppData\Roaming\Download\478534.exe
                            "C:\Users\Admin\AppData\Roaming\Download\478534.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            PID:4812
                            • C:\Users\Admin\AppData\Roaming\Download\478534.exe
                              "C:\Users\Admin\AppData\Roaming\Download\478534.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:5708
                          • C:\Users\Admin\AppData\Roaming\Download\865532.exe
                            "C:\Users\Admin\AppData\Roaming\Download\865532.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            PID:3652
                            • C:\Users\Admin\AppData\Roaming\Download\865532.exe
                              "C:\Users\Admin\AppData\Roaming\Download\865532.exe"
                              5⤵
                                PID:2532
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                          2⤵
                          • Drops file in Program Files directory
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:1300
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x35c,0x7ffab616c188,0x7ffab616c194,0x7ffab616c1a0
                            3⤵
                              PID:2852
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14571610249136780822,3311760054079339552,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
                              3⤵
                              • System Time Discovery
                              PID:4804
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6825044244339592408,7429575115594474132,262144 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
                              3⤵
                                PID:1680
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,7326354856164185812,8950106309544297695,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
                                3⤵
                                  PID:2072
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15208813124443243640,2223017507562914403,2097152 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
                                  3⤵
                                    PID:5080
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,5259594945440863581,16143801510206423416,2097152 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
                                    3⤵
                                      PID:400
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,2894452745118471211,9437739616867505251,2097152 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
                                      3⤵
                                        PID:2836
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,12284037234786605678,17299562496116612252,2097152 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
                                        3⤵
                                          PID:4184
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14923925130398008773,8772292955501903914,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
                                          3⤵
                                            PID:380
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5276,i,9322898241977793793,8362223439765424203,2097152 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
                                            3⤵
                                              PID:3992
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1620,i,16539947621950982415,301220137529496203,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
                                              3⤵
                                                PID:3048
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,13842970826995738893,7057515975403387957,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
                                                3⤵
                                                  PID:4560
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10059576792870670924,13682762086917869784,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
                                                  3⤵
                                                  • Modifies registry class
                                                  PID:5832
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15471778715278436265,6852843122507997531,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
                                                  3⤵
                                                    PID:5840
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3704,i,2774696883238897847,10400897649825245239,2097152 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
                                                    3⤵
                                                      PID:3704
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,686977460035989369,4766004631101581199,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
                                                      3⤵
                                                        PID:5792
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,686977460035989369,4766004631101581199,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
                                                        3⤵
                                                          PID:5884
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,9137105844827859553,10738339868772922495,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
                                                          3⤵
                                                            PID:5416
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,4798035149084352062,3438744006774312075,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
                                                            3⤵
                                                              PID:5236
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,9203253998445103628,5981664656310449577,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
                                                              3⤵
                                                                PID:5768
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,9148894552713087287,12666688617383953404,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
                                                                3⤵
                                                                  PID:5744
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,9030709307161151528,10439731681544353664,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
                                                                  3⤵
                                                                    PID:2736
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,5059235503630122531,13456027847335477729,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:8
                                                                    3⤵
                                                                      PID:5252
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8166347409013834067,7313912769814519965,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
                                                                      3⤵
                                                                        PID:4164
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,17132225387940720356,15937286782325353780,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
                                                                        3⤵
                                                                          PID:5780
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,16222778780634380394,8729366026756850748,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
                                                                          3⤵
                                                                            PID:2184
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,748339140167453949,3028071067638414113,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
                                                                            3⤵
                                                                              PID:2124
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=852,i,5066573438685383125,16015210608978266377,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
                                                                              3⤵
                                                                                PID:1872
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,7477094696957525812,9303595241469346737,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
                                                                                3⤵
                                                                                  PID:5856
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,16160553358798515009,15390500886160014253,262144 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
                                                                                  3⤵
                                                                                    PID:4648
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,7151134100803980521,1401254926363164046,524288 --field-trial-handle=2232,i,6593803242963419676,15106734080643841772,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
                                                                                    3⤵
                                                                                      PID:5360
                                                                                  • C:\Windows\explorer.exe
                                                                                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                    2⤵
                                                                                      PID:3704
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                    1⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3224
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                      2⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:2256
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:5096
                                                                                    • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                      1⤵
                                                                                        PID:5884
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                        1⤵
                                                                                          PID:1156
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
                                                                                          1⤵
                                                                                            PID:5228

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                DouTuDaShi.exe
                                                                                                • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                • Size 1.1MB
                                                                                                • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1300_1213287260\manifest.json
                                                                                                • Size 165B
                                                                                                • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1300_1336724072\manifest.json
                                                                                                • Size 43B
                                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1300_1710871937\manifest.json
                                                                                                • Size 160B
                                                                                                • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1300_731497208\manifest.json
                                                                                                • Size 135B
                                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
                                                                                                • Size 2KB
                                                                                                • SHA256 b265e8eafbdd67108f38f7bcb99fdefe84aa0aa7121a0c3077078b6cc936b81e
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
                                                                                                • Size 484B
                                                                                                • SHA256 c4e35913467c676942030202dd66e83ea14470f714ac96680f662c35cd7aa09b
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                protocols.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                                • Size 3KB
                                                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 280B
                                                                                                • SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 280B
                                                                                                • SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                96f9b4f9adf74a24_0
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                • Size 213B
                                                                                                • SHA256 a58bbcc77c02e11bfaf41412cdb2a03bd143d20aef4df8db866ddc76ffc58e90
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                df36dda3fc61f9c6_0
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df36dda3fc61f9c6_0
                                                                                                • Size 219B
                                                                                                • SHA256 f7e55466f14e91e80648b5b3e82b5410fe75ae403ce5ef864078a04826c06c2a
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 4KB
                                                                                                • SHA256 33faf0e7d854f4f70e6515c6fc5482a8ccd0fd77057fb9e1ea4fef4b99303bfe
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                the-real-index~RFe5947ec.TMP
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5947ec.TMP
                                                                                                • Size 3KB
                                                                                                • SHA256 566727b848a6d9e2e187ead6c13515aac29917ea171349a394dee1955314cbe8
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Edge Profile.ico
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                • Size 70KB
                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                verified_contents.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
                                                                                                • Size 1KB
                                                                                                • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Network Persistent State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                • Size 111B
                                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Network Persistent State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                • Size 6KB
                                                                                                • SHA256 88bf3c293c26160535c5f8ffeae1038a07f4cfa78ec18a10f5ed76a53fdb2914
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SCT Auditing Pending Reports
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                • Size 2B
                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 10KB
                                                                                                • SHA256 e79c758275b6096fce045421dec77dafd353b472db4cd1a22b0bf09e0604da87
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 11KB
                                                                                                • SHA256 227747dfac2c84a4f3a70cbed6fd727d6f41a47c905ee489746aa2f72a32620f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 11KB
                                                                                                • SHA256 c38539a7e38c8be7421c6f5f02eed01e838a81c75d40462dfb88bb45e3fe74a4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Secure Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                • Size 27KB
                                                                                                • SHA256 64a09eedc2d666e96e1103986e4bdb19b02d751ad7a38bc81eda6d5e6a9ac060
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                office_endpoints_list.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                • Size 9KB
                                                                                                • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 12KB
                                                                                                • SHA256 36585fa9ab0fe4a38e4841f42e5475d7954cb0dad4c7b6a926a04abd5c8e1512
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 8KB
                                                                                                • SHA256 1153bf534923f674ad10c1fb8ae964b9f3c2abdef5ea781db5751958db038ab6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 18KB
                                                                                                • SHA256 35353af89abf847757904371affeff78dcdbee347e3514ab77bfa5a932e8b6f9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 18KB
                                                                                                • SHA256 5dcc92e53f6efcd38f4cf0d38632420b3d262a53816accd7148da737c20bb7ec
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 23KB
                                                                                                • SHA256 886363451545e3b7dae6088d9d1d358d91f4797459d0b72b08090358cd0d1de3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 8KB
                                                                                                • SHA256 9360e2117c16eca901979d78feaa08c64d10c2521bb5a695224e8d7339e8f27d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                nav_config.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                • Size 2KB
                                                                                                • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                metadata.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                • Size 252B
                                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                metadata.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                • Size 372B
                                                                                                • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                metadata.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                • Size 132B
                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                d9e5fe2b-87cd-45f2-a898-f94d1f018776.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d9e5fe2b-87cd-45f2-a898-f94d1f018776.tmp
                                                                                                • Size 13B
                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\15F8PKG3\hao.360[1].xml
                                                                                                • Size 2KB
                                                                                                • SHA256 48c8ab17af7302e533ba2cbe436ba0ff2444dc61eaf64aecc9db7c1fd782d44e
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\15F8PKG3\hao.360[1].xml
                                                                                                • Size 50KB
                                                                                                • SHA256 d32ea1f5599bc837ba51089f7c0d591f380c8bfef43e0026955c2c46fecce31f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\15F8PKG3\hao.360[1].xml
                                                                                                • Size 55KB
                                                                                                • SHA256 4447aabc70cb9d3525ee3e728fe6ccdf80dac73a235098a678efe11ffcb12762
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Size 2KB
                                                                                                • SHA256 1590a19c5053e8ab396f0665ed9f8ac1aa35dbf9b677a910066b84d9784766a0
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                0[1].png
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9JFLGHHP\0[1].png
                                                                                                • Size 574B
                                                                                                • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                time[1].js
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IG9UOCZZ\time[1].js
                                                                                                • Size 27B
                                                                                                • SHA256 0723799b08d34f02b99ff853c43a609590241aec90606acf66943572f18e77e4
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                sed_api_weather_info[1].htm
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y8RORA7G\sed_api_weather_info[1].htm
                                                                                                • Size 8KB
                                                                                                • SHA256 79aa640e67560ef98049379579ddc4195264aada0d8e9203b79a4f4fe12f79ab
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                113[1].js
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YXTWWJCG\113[1].js
                                                                                                • Size 61KB
                                                                                                • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                74514cbd-ac50-4fe1-83f6-bf209693463b.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\74514cbd-ac50-4fe1-83f6-bf209693463b.tmp
                                                                                                • Size 1B
                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                9787459c-beae-49e3-ac87-dbd6e6a37b9f.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9787459c-beae-49e3-ac87-dbd6e6a37b9f.tmp
                                                                                                • Size 10KB
                                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ldsajdklsajdlkjsalkda.bat
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                • Size 589B
                                                                                                • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                oxtjun.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oxtjun.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 7516097411561914601fc27f69dda0a8d1e6e6579734c07d2cca566b703ca4c3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                content_new.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1300_1363034233\CRX_INSTALL\content_new.js
                                                                                                • Size 10KB
                                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1300_1363034233\CRX_INSTALL\manifest.json
                                                                                                • Size 962B
                                                                                                • SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                b8be307c-66e1-4745-bc35-b116be1cf8c4.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1300_1535812664\b8be307c-66e1-4745-bc35-b116be1cf8c4.tmp
                                                                                                • Size 157KB
                                                                                                • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                114871.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\114871.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 b8d4fc15fd92690b92872185e5809019050f0cede0adf43935a1207f009a8900
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                160662.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\160662.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 dd70992cfff1151b8aa2d991f596f2516157cc349addb27eb92e588d5a707b80
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                228807.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\228807.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 4611c243e2b32d337b5781133682089793aaab6110224c76bba9c0906e84fdc9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                266381.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\266381.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 473139e94bebf1fdaa06925d5675a5fb6878aec35b25725c71ce864a2bd631ed
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                379444.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\379444.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 09c7ba3c2406501fc846fa5f7105b49246f205d631e7b86a363c55a524525f5e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                446806.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\446806.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 e9d04dce6f84dffa80b6f1750eb74bf570367369a3f3dc833d1020d01a8155f9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                502700.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\502700.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 ec2344d803d49e8e13d9c75eb1508587a73d4907234bab19c7c34d23d474760e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                719301.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\719301.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 632851d3e56971543943cc49771c52f6d28f3ec1d0c9b0e6f952197ee849c154
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                819843.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\819843.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 40cc6c7075e7f4b13f268d77495a0140bd6e95a8635fcdaaab0d8b26a4ddb7e9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                829115.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\829115.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 960bdd33d827ffc1e35c7639a580fce08e008f73e6eab52859222decf7324b7d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                889507.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\889507.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 b6b435021b684241b5ab6a8b138b4da57e649476a4b92afacb59c168ef894166
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                893665.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\893665.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 07a7d58ac8f0b17ed69a1dfc68fe64d50da386e209c87ef6af8060498cc87573
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                memory/1600-137-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/5092-183-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/5092-1165-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/5092-1631-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/5092-745-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/5092-1021-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download