Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_271f8202fe46118a7e881aebf94a6583_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-epmalswarg
  • SHA256 29369076a9c32dbbeca01224e74e09fbb4da57be689350f41ccb5716ecc2f957
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_271f8202fe46118a7e881aebf94a6583_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_271f8202fe46118a7e881aebf94a6583_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1312
    • C:\Users\Admin\AppData\Local\Temp\pnsjlb.exe
      "C:\Users\Admin\AppData\Local\Temp\pnsjlb.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Users\Admin\AppData\Local\Temp\pnsjlb.exe
        "C:\Users\Admin\AppData\Local\Temp\pnsjlb.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Users\Admin\AppData\Roaming\Download\107245.exe
          "C:\Users\Admin\AppData\Roaming\Download\107245.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:452
          • C:\Users\Admin\AppData\Roaming\Download\107245.exe
            "C:\Users\Admin\AppData\Roaming\Download\107245.exe"
            5⤵
            • Executes dropped EXE
            PID:4372
        • C:\Users\Admin\AppData\Roaming\Download\607003.exe
          "C:\Users\Admin\AppData\Roaming\Download\607003.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4148
          • C:\Users\Admin\AppData\Roaming\Download\607003.exe
            "C:\Users\Admin\AppData\Roaming\Download\607003.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4324
        • C:\Users\Admin\AppData\Roaming\Download\742284.exe
          "C:\Users\Admin\AppData\Roaming\Download\742284.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Users\Admin\AppData\Roaming\Download\742284.exe
            "C:\Users\Admin\AppData\Roaming\Download\742284.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3936
        • C:\Users\Admin\AppData\Roaming\Download\837341.exe
          "C:\Users\Admin\AppData\Roaming\Download\837341.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5028
          • C:\Users\Admin\AppData\Roaming\Download\837341.exe
            "C:\Users\Admin\AppData\Roaming\Download\837341.exe"
            5⤵
            • Executes dropped EXE
            PID:5420
        • C:\Users\Admin\AppData\Roaming\Download\337065.exe
          "C:\Users\Admin\AppData\Roaming\Download\337065.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5580
          • C:\Users\Admin\AppData\Roaming\Download\337065.exe
            "C:\Users\Admin\AppData\Roaming\Download\337065.exe"
            5⤵
            • Executes dropped EXE
            PID:5760
        • C:\Users\Admin\AppData\Roaming\Download\470321.exe
          "C:\Users\Admin\AppData\Roaming\Download\470321.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6112
          • C:\Users\Admin\AppData\Roaming\Download\470321.exe
            "C:\Users\Admin\AppData\Roaming\Download\470321.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4280
        • C:\Users\Admin\AppData\Roaming\Download\492487.exe
          "C:\Users\Admin\AppData\Roaming\Download\492487.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\Users\Admin\AppData\Roaming\Download\492487.exe
            "C:\Users\Admin\AppData\Roaming\Download\492487.exe"
            5⤵
            • Executes dropped EXE
            PID:1064
        • C:\Users\Admin\AppData\Roaming\Download\303838.exe
          "C:\Users\Admin\AppData\Roaming\Download\303838.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4740
          • C:\Users\Admin\AppData\Roaming\Download\303838.exe
            "C:\Users\Admin\AppData\Roaming\Download\303838.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3708
        • C:\Users\Admin\AppData\Roaming\Download\760626.exe
          "C:\Users\Admin\AppData\Roaming\Download\760626.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5860
          • C:\Users\Admin\AppData\Roaming\Download\760626.exe
            "C:\Users\Admin\AppData\Roaming\Download\760626.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5948
        • C:\Users\Admin\AppData\Roaming\Download\813992.exe
          "C:\Users\Admin\AppData\Roaming\Download\813992.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2304
          • C:\Users\Admin\AppData\Roaming\Download\813992.exe
            "C:\Users\Admin\AppData\Roaming\Download\813992.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2476
        • C:\Users\Admin\AppData\Roaming\Download\837058.exe
          "C:\Users\Admin\AppData\Roaming\Download\837058.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3844
          • C:\Users\Admin\AppData\Roaming\Download\837058.exe
            "C:\Users\Admin\AppData\Roaming\Download\837058.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5912
        • C:\Users\Admin\AppData\Roaming\Download\938509.exe
          "C:\Users\Admin\AppData\Roaming\Download\938509.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:680
          • C:\Users\Admin\AppData\Roaming\Download\938509.exe
            "C:\Users\Admin\AppData\Roaming\Download\938509.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5592
        • C:\Users\Admin\AppData\Roaming\Download\205396.exe
          "C:\Users\Admin\AppData\Roaming\Download\205396.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5932
          • C:\Users\Admin\AppData\Roaming\Download\205396.exe
            "C:\Users\Admin\AppData\Roaming\Download\205396.exe"
            5⤵
            • Executes dropped EXE
            PID:5920
        • C:\Users\Admin\AppData\Roaming\Download\248662.exe
          "C:\Users\Admin\AppData\Roaming\Download\248662.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5988
          • C:\Users\Admin\AppData\Roaming\Download\248662.exe
            "C:\Users\Admin\AppData\Roaming\Download\248662.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6064
        • C:\Users\Admin\AppData\Roaming\Download\186371.exe
          "C:\Users\Admin\AppData\Roaming\Download\186371.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3648
          • C:\Users\Admin\AppData\Roaming\Download\186371.exe
            "C:\Users\Admin\AppData\Roaming\Download\186371.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3948
        • C:\Users\Admin\AppData\Roaming\Download\796100.exe
          "C:\Users\Admin\AppData\Roaming\Download\796100.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5472
          • C:\Users\Admin\AppData\Roaming\Download\796100.exe
            "C:\Users\Admin\AppData\Roaming\Download\796100.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5796
        • C:\Users\Admin\AppData\Roaming\Download\719266.exe
          "C:\Users\Admin\AppData\Roaming\Download\719266.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6068
          • C:\Users\Admin\AppData\Roaming\Download\719266.exe
            "C:\Users\Admin\AppData\Roaming\Download\719266.exe"
            5⤵
            • Executes dropped EXE
            PID:6080
        • C:\Users\Admin\AppData\Roaming\Download\309171.exe
          "C:\Users\Admin\AppData\Roaming\Download\309171.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:212
          • C:\Users\Admin\AppData\Roaming\Download\309171.exe
            "C:\Users\Admin\AppData\Roaming\Download\309171.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2644
        • C:\Users\Admin\AppData\Roaming\Download\942073.exe
          "C:\Users\Admin\AppData\Roaming\Download\942073.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2324
          • C:\Users\Admin\AppData\Roaming\Download\942073.exe
            "C:\Users\Admin\AppData\Roaming\Download\942073.exe"
            5⤵
            • Executes dropped EXE
            PID:3660
        • C:\Users\Admin\AppData\Roaming\Download\474522.exe
          "C:\Users\Admin\AppData\Roaming\Download\474522.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2904
          • C:\Users\Admin\AppData\Roaming\Download\474522.exe
            "C:\Users\Admin\AppData\Roaming\Download\474522.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4360
        • C:\Users\Admin\AppData\Roaming\Download\489660.exe
          "C:\Users\Admin\AppData\Roaming\Download\489660.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4960
          • C:\Users\Admin\AppData\Roaming\Download\489660.exe
            "C:\Users\Admin\AppData\Roaming\Download\489660.exe"
            5⤵
            • Executes dropped EXE
            PID:5764
        • C:\Users\Admin\AppData\Roaming\Download\856468.exe
          "C:\Users\Admin\AppData\Roaming\Download\856468.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5972
          • C:\Users\Admin\AppData\Roaming\Download\856468.exe
            "C:\Users\Admin\AppData\Roaming\Download\856468.exe"
            5⤵
            • Executes dropped EXE
            PID:5996
        • C:\Users\Admin\AppData\Roaming\Download\857918.exe
          "C:\Users\Admin\AppData\Roaming\Download\857918.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6036
          • C:\Users\Admin\AppData\Roaming\Download\857918.exe
            "C:\Users\Admin\AppData\Roaming\Download\857918.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2296
        • C:\Users\Admin\AppData\Roaming\Download\871274.exe
          "C:\Users\Admin\AppData\Roaming\Download\871274.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2768
          • C:\Users\Admin\AppData\Roaming\Download\871274.exe
            "C:\Users\Admin\AppData\Roaming\Download\871274.exe"
            5⤵
            • Executes dropped EXE
            PID:6104
        • C:\Users\Admin\AppData\Roaming\Download\127157.exe
          "C:\Users\Admin\AppData\Roaming\Download\127157.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3960
          • C:\Users\Admin\AppData\Roaming\Download\127157.exe
            "C:\Users\Admin\AppData\Roaming\Download\127157.exe"
            5⤵
            • Executes dropped EXE
            PID:1528
        • C:\Users\Admin\AppData\Roaming\Download\516861.exe
          "C:\Users\Admin\AppData\Roaming\Download\516861.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5536
          • C:\Users\Admin\AppData\Roaming\Download\516861.exe
            "C:\Users\Admin\AppData\Roaming\Download\516861.exe"
            5⤵
            • Executes dropped EXE
            PID:2408
        • C:\Users\Admin\AppData\Roaming\Download\741844.exe
          "C:\Users\Admin\AppData\Roaming\Download\741844.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5348
          • C:\Users\Admin\AppData\Roaming\Download\741844.exe
            "C:\Users\Admin\AppData\Roaming\Download\741844.exe"
            5⤵
            • Executes dropped EXE
            PID:1560
        • C:\Users\Admin\AppData\Roaming\Download\138841.exe
          "C:\Users\Admin\AppData\Roaming\Download\138841.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6056
          • C:\Users\Admin\AppData\Roaming\Download\138841.exe
            "C:\Users\Admin\AppData\Roaming\Download\138841.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6008
        • C:\Users\Admin\AppData\Roaming\Download\011092.exe
          "C:\Users\Admin\AppData\Roaming\Download\011092.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:816
          • C:\Users\Admin\AppData\Roaming\Download\011092.exe
            "C:\Users\Admin\AppData\Roaming\Download\011092.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5012
        • C:\Users\Admin\AppData\Roaming\Download\267273.exe
          "C:\Users\Admin\AppData\Roaming\Download\267273.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5172
          • C:\Users\Admin\AppData\Roaming\Download\267273.exe
            "C:\Users\Admin\AppData\Roaming\Download\267273.exe"
            5⤵
            • Executes dropped EXE
            PID:1048
        • C:\Users\Admin\AppData\Roaming\Download\652060.exe
          "C:\Users\Admin\AppData\Roaming\Download\652060.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2408
          • C:\Users\Admin\AppData\Roaming\Download\652060.exe
            "C:\Users\Admin\AppData\Roaming\Download\652060.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5704
        • C:\Users\Admin\AppData\Roaming\Download\535311.exe
          "C:\Users\Admin\AppData\Roaming\Download\535311.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:6000
          • C:\Users\Admin\AppData\Roaming\Download\535311.exe
            "C:\Users\Admin\AppData\Roaming\Download\535311.exe"
            5⤵
              PID:3024
          • C:\Users\Admin\AppData\Roaming\Download\688579.exe
            "C:\Users\Admin\AppData\Roaming\Download\688579.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:1668
            • C:\Users\Admin\AppData\Roaming\Download\688579.exe
              "C:\Users\Admin\AppData\Roaming\Download\688579.exe"
              5⤵
                PID:240
            • C:\Users\Admin\AppData\Roaming\Download\704550.exe
              "C:\Users\Admin\AppData\Roaming\Download\704550.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:4380
              • C:\Users\Admin\AppData\Roaming\Download\704550.exe
                "C:\Users\Admin\AppData\Roaming\Download\704550.exe"
                5⤵
                  PID:5568
              • C:\Users\Admin\AppData\Roaming\Download\956816.exe
                "C:\Users\Admin\AppData\Roaming\Download\956816.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:6096
                • C:\Users\Admin\AppData\Roaming\Download\956816.exe
                  "C:\Users\Admin\AppData\Roaming\Download\956816.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:6060
              • C:\Users\Admin\AppData\Roaming\Download\182808.exe
                "C:\Users\Admin\AppData\Roaming\Download\182808.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:2292
                • C:\Users\Admin\AppData\Roaming\Download\182808.exe
                  "C:\Users\Admin\AppData\Roaming\Download\182808.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4904
              • C:\Users\Admin\AppData\Roaming\Download\840061.exe
                "C:\Users\Admin\AppData\Roaming\Download\840061.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:1528
                • C:\Users\Admin\AppData\Roaming\Download\840061.exe
                  "C:\Users\Admin\AppData\Roaming\Download\840061.exe"
                  5⤵
                    PID:640
                • C:\Users\Admin\AppData\Roaming\Download\921592.exe
                  "C:\Users\Admin\AppData\Roaming\Download\921592.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5816
                  • C:\Users\Admin\AppData\Roaming\Download\921592.exe
                    "C:\Users\Admin\AppData\Roaming\Download\921592.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1840
                • C:\Users\Admin\AppData\Roaming\Download\095482.exe
                  "C:\Users\Admin\AppData\Roaming\Download\095482.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5936
                  • C:\Users\Admin\AppData\Roaming\Download\095482.exe
                    "C:\Users\Admin\AppData\Roaming\Download\095482.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5644
                • C:\Users\Admin\AppData\Roaming\Download\996933.exe
                  "C:\Users\Admin\AppData\Roaming\Download\996933.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:1928
                  • C:\Users\Admin\AppData\Roaming\Download\996933.exe
                    "C:\Users\Admin\AppData\Roaming\Download\996933.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3280
                • C:\Users\Admin\AppData\Roaming\Download\219099.exe
                  "C:\Users\Admin\AppData\Roaming\Download\219099.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  PID:6120
                  • C:\Users\Admin\AppData\Roaming\Download\219099.exe
                    "C:\Users\Admin\AppData\Roaming\Download\219099.exe"
                    5⤵
                      PID:2396
                  • C:\Users\Admin\AppData\Roaming\Download\365172.exe
                    "C:\Users\Admin\AppData\Roaming\Download\365172.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:1940
                    • C:\Users\Admin\AppData\Roaming\Download\365172.exe
                      "C:\Users\Admin\AppData\Roaming\Download\365172.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3708
                  • C:\Users\Admin\AppData\Roaming\Download\868581.exe
                    "C:\Users\Admin\AppData\Roaming\Download\868581.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:5776
                    • C:\Users\Admin\AppData\Roaming\Download\868581.exe
                      "C:\Users\Admin\AppData\Roaming\Download\868581.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5960
                  • C:\Users\Admin\AppData\Roaming\Download\081859.exe
                    "C:\Users\Admin\AppData\Roaming\Download\081859.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:1072
                    • C:\Users\Admin\AppData\Roaming\Download\081859.exe
                      "C:\Users\Admin\AppData\Roaming\Download\081859.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:880
                  • C:\Users\Admin\AppData\Roaming\Download\133135.exe
                    "C:\Users\Admin\AppData\Roaming\Download\133135.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:3540
                    • C:\Users\Admin\AppData\Roaming\Download\133135.exe
                      "C:\Users\Admin\AppData\Roaming\Download\133135.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5676
                  • C:\Users\Admin\AppData\Roaming\Download\016365.exe
                    "C:\Users\Admin\AppData\Roaming\Download\016365.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:4028
                    • C:\Users\Admin\AppData\Roaming\Download\016365.exe
                      "C:\Users\Admin\AppData\Roaming\Download\016365.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:6064
                  • C:\Users\Admin\AppData\Roaming\Download\446805.exe
                    "C:\Users\Admin\AppData\Roaming\Download\446805.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:892
                    • C:\Users\Admin\AppData\Roaming\Download\446805.exe
                      "C:\Users\Admin\AppData\Roaming\Download\446805.exe"
                      5⤵
                        PID:4456
                    • C:\Users\Admin\AppData\Roaming\Download\892075.exe
                      "C:\Users\Admin\AppData\Roaming\Download\892075.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:4160
                      • C:\Users\Admin\AppData\Roaming\Download\892075.exe
                        "C:\Users\Admin\AppData\Roaming\Download\892075.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4836
                    • C:\Users\Admin\AppData\Roaming\Download\814153.exe
                      "C:\Users\Admin\AppData\Roaming\Download\814153.exe" /Shorttailedrestart
                      4⤵
                        PID:1756
                        • C:\Users\Admin\AppData\Roaming\Download\814153.exe
                          "C:\Users\Admin\AppData\Roaming\Download\814153.exe"
                          5⤵
                            PID:2276
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                      2⤵
                      • Drops file in Program Files directory
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies registry class
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffbdefbc188,0x7ffbdefbc194,0x7ffbdefbc1a0
                        3⤵
                          PID:2648
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3324616391241639636,2605357215121436093,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
                          3⤵
                          • System Time Discovery
                          PID:4856
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1252090500445542634,12165320851663431815,262144 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
                          3⤵
                            PID:2652
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1636,i,16188455705815072540,8869268696752818678,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
                            3⤵
                              PID:2204
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,5570397471089240400,8230569571802443946,2097152 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
                              3⤵
                                PID:1580
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,4951771316265482225,17404022561444187985,2097152 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
                                3⤵
                                  PID:2848
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,17324586117486828987,14024357346809591909,2097152 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
                                  3⤵
                                    PID:3848
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,3853196974607442155,8863533504795019776,2097152 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:2
                                    3⤵
                                      PID:3960
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,16940008430630876702,7502608976253900655,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
                                      3⤵
                                        PID:3112
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,9217117225751212746,10130060205088349506,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
                                        3⤵
                                          PID:3608
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5240,i,14988542540575047017,2233238158657717211,2097152 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
                                          3⤵
                                            PID:5212
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,10890393670399918743,12944425554693794021,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
                                            3⤵
                                              PID:5340
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,12159866518933155608,2254658588111654610,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
                                              3⤵
                                                PID:5348
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,6647936908930778235,9104040584435952515,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
                                                3⤵
                                                  PID:5628
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,6647936908930778235,9104040584435952515,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
                                                  3⤵
                                                    PID:5668
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,11019297292207777247,8449306557627240765,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
                                                    3⤵
                                                      PID:3928
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,10036905434767819678,1654978212005457173,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
                                                      3⤵
                                                        PID:3552
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,1794289654344690731,9440004691165005833,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
                                                        3⤵
                                                          PID:5380
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5018971631037644599,18360531882614629577,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
                                                          3⤵
                                                            PID:5388
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,7437956338920078453,2923305216478394423,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
                                                            3⤵
                                                              PID:5236
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,3038458426587001138,3934661728963051746,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
                                                              3⤵
                                                                PID:5560
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2721723321196679012,15548625379040188878,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
                                                                3⤵
                                                                  PID:5552
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16656367547849403610,15970660931922297348,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
                                                                  3⤵
                                                                    PID:5564
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,8860314049379007054,3165838365773454022,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
                                                                    3⤵
                                                                      PID:2628
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11384370945149318355,2419025840181177495,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
                                                                      3⤵
                                                                        PID:1124
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,15203697225468942863,9979544148739819440,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
                                                                        3⤵
                                                                          PID:896
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,14178182222914035725,12574262569772107937,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
                                                                          3⤵
                                                                          • Modifies registry class
                                                                          PID:2320
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,5187028258730852662,6429508062154706175,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
                                                                          3⤵
                                                                            PID:5864
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4424,i,7126883290570883252,11020951742744507840,2097152 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
                                                                            3⤵
                                                                              PID:6128
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,15046905573086997211,4110741190220924677,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
                                                                              3⤵
                                                                                PID:2220
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,17895280862189046350,14860478859191087509,262144 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
                                                                                3⤵
                                                                                  PID:3624
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,18012588580570541406,12622004513339166268,524288 --field-trial-handle=2188,i,7381107627273126917,8609457932017172430,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:8
                                                                                  3⤵
                                                                                    PID:5852
                                                                                • C:\Windows\explorer.exe
                                                                                  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                  2⤵
                                                                                    PID:2372
                                                                                • C:\Windows\explorer.exe
                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                  1⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4632
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                    2⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:2644
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:2420
                                                                                  • C:\Windows\System32\sihclient.exe
                                                                                    C:\Windows\System32\sihclient.exe /cv /Olua99Fe0C+4nN3TAxHhQ.0.2
                                                                                    1⤵
                                                                                      PID:1064

                                                                                    Network

                                                                                          MITRE ATT&CK Enterprise v16

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          DouTuDaShi.exe
                                                                                          • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                          • Size 1.1MB
                                                                                          • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3032_1465954554\manifest.json
                                                                                          • Size 135B
                                                                                          • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3032_1675966086\manifest.json
                                                                                          • Size 165B
                                                                                          • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3032_65718121\manifest.json
                                                                                          • Size 160B
                                                                                          • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3032_92229754\manifest.json
                                                                                          • Size 43B
                                                                                          • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          1238ef88-390b-4ca6-a9b0-261f09bb4b4f.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1238ef88-390b-4ca6-a9b0-261f09bb4b4f.tmp
                                                                                          • Size 18KB
                                                                                          • SHA256 b045032af48fc6567ec38b969dde88ce37a9308fbd7e4eedb33786faeb539d68
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          blocklist
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                          • Size 105KB
                                                                                          • SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          protocols.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                          • Size 3KB
                                                                                          • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          13797c83-c8f6-4a9f-a3e1-a1df96cc0c32.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13797c83-c8f6-4a9f-a3e1-a1df96cc0c32.tmp
                                                                                          • Size 32KB
                                                                                          • SHA256 0875b32872d55b756011b212fde7869bf94e48da6cc8884700a44b1c65edefc1
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          BookmarkMergedSurfaceOrdering
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                          • Size 6B
                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 3KB
                                                                                          • SHA256 7c2139268740e333f60d018b2b2da3e693213a4d7d7f204d48117dd186c59fb5
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 3KB
                                                                                          • SHA256 fe418f26f5f9eb74302f33750bd021a6c3e2e3268a17d005ca647f7449b5fe78
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 4d4cb2b4e0de9e4b6fd34880c54ebcbfb12c19f22ab80e39531fa769a1a068ec
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index~RFe5933d8.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5933d8.TMP
                                                                                          • Size 3KB
                                                                                          • SHA256 31addb6c8421bf1fefa670646156c2658faaf0a0f09d038a605ba3cdcf260a0e
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          SiteList-Enterprise.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                          • Size 2B
                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Edge Profile.ico
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                          • Size 70KB
                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 111B
                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 2KB
                                                                                          • SHA256 473c22bf070d1680058153014bc84e4af94642be9ba693f379157e67da0b3e47
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 6KB
                                                                                          • SHA256 bde5ba244adc9e856df2ce1f6de35380f4a23b0066bf9217566b32d31a853f81
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          SCT Auditing Pending Reports
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                          • Size 2B
                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 10KB
                                                                                          • SHA256 4064c375ea3892a35b22b578966cfae01b8503420a4bbb88ee76a646c07886e7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 11KB
                                                                                          • SHA256 4c37aea0d307d25dc5b4c5ec50585b93d3fe8c1de9990d2eb8fae7b58b29d0dc
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 10KB
                                                                                          • SHA256 b2f8664cacf2859d3d538320499ada2b4a0cc259c83199ef484f6d2c1b428778
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 11KB
                                                                                          • SHA256 3b8a02007f4c4951f12afb4b8ab37f0c168a1f86ff48c749e3622f04d298d564
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          sync_diagnostic.log
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                          • Size 6KB
                                                                                          • SHA256 32897f691677fd491f833e8705e2b05087dd91d443566273cb989c007764c366
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          OperationConfig
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                          • Size 22KB
                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          OperationConfig~RFe59cf5c.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cf5c.TMP
                                                                                          • Size 3KB
                                                                                          • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          office_endpoints_list.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                          • Size 9KB
                                                                                          • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 18KB
                                                                                          • SHA256 eefd216f6e6139479fc0f5f2e721e6d6c5f1723a8714035a27e9385608140e64
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 7cdbc864b865bea058df0a89d28f0fa39edd0aa67a3fca930c7413de651e6e40
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 e8154f28057d4120856ede3c214f9237f2faeb72c5a324c982ff9a98a56f1fad
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 28KB
                                                                                          • SHA256 7bb8551b9f98dfed5e724fe71c95cfbbbf674210785e4fc72107550adee73c0e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          nav_config.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                          • Size 2KB
                                                                                          • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 252B
                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 372B
                                                                                          • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 132B
                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          cf049b7d-b590-4c59-96bc-8291c7a573e8.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cf049b7d-b590-4c59-96bc-8291c7a573e8.tmp
                                                                                          • Size 13B
                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          hao.360[1].xml
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TMDBJ0T2\hao.360[1].xml
                                                                                          • Size 2KB
                                                                                          • SHA256 8a1568b96eb1fa971d07463422e9c6daef5532291bf3774c21159a3c47fae019
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Size 2KB
                                                                                          • SHA256 7fa70fe3b71c749269747f7f9d12da2128b0092a727b0967b20a2028606ed7f8
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          113[1].js
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\113[1].js
                                                                                          • Size 61KB
                                                                                          • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          sed_api_weather_info[1].htm
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\sed_api_weather_info[1].htm
                                                                                          • Size 8KB
                                                                                          • SHA256 9975ce2f59aa37fa35e415039eea03f8cff4128848ec9882c5c00bb5f48ba6bd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          time[1].js
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FOWD993E\time[1].js
                                                                                          • Size 27B
                                                                                          • SHA256 0647b991b449c39f7df6b3928fabbb7585205f2478dcfdf6ca5442213e1f3bb9
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          0[1].png
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SZA3OMON\0[1].png
                                                                                          • Size 574B
                                                                                          • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          524e0faf-9e72-4131-ab8b-c100bd8bf242.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\524e0faf-9e72-4131-ab8b-c100bd8bf242.tmp
                                                                                          • Size 1B
                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          fb090970-dfe4-47fc-ac7c-661805167fbc.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\fb090970-dfe4-47fc-ac7c-661805167fbc.tmp
                                                                                          • Size 10KB
                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          ldsajdklsajdlkjsalkda.bat
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                          • Size 589B
                                                                                          • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          pnsjlb.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\pnsjlb.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 29369076a9c32dbbeca01224e74e09fbb4da57be689350f41ccb5716ecc2f957
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          4185b8a4-fe02-4618-9558-15730b067bce.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1853690015\4185b8a4-fe02-4618-9558-15730b067bce.tmp
                                                                                          • Size 157KB
                                                                                          • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          content_new.js
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_709532215\CRX_INSTALL\content_new.js
                                                                                          • Size 10KB
                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          107245.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\107245.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 973d514781569f6769f50472bb061a783d39db765262a54690a566853f01472b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          205396.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\205396.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 7a3011f08c15a1025fc12f75ebd6d7100a7f5a80e837425ce25960f86477dbab
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          303838.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\303838.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 147a6bf9ae23206ee08d75c6f271334f127fffc6da3e0a13eb146f106ddf89bd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          337065.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\337065.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 66c21906df0167a9a9503b02a1e9909f17f04a120700e928de164daaf9891842
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          470321.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\470321.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 d1313f2ee785920b560c9b2d2c469a53ada342285d3be42b1319d27ed49f5827
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          492487.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\492487.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 c7d4a846f14d996fa52f4f11e776b6ebba9794b406838f9a459122678e9a7eee
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          607003.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\607003.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 1e12ada9725f958a5b315b93af516c9a92ff4687f06ff5196e34359c5ff8f686
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          742284.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\742284.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 d2ed65663aa8159fbf83aa4aa4c8faeb13daf95ac8a024eaf00dfb48b67c843c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          760626.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\760626.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 4bc6a9d5309e7446c77dd9b35ba359a0277e93fc9289a386183298e92c650048
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          813992.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\813992.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 327609a2f28b4b82331c7c76d8cc05415a4cc1a9a31c0853f0a580ae34352db0
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          837058.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\837058.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 ae7a24b4b9e27f17d182d77390598b6c9f41841e89e36c0106d6c9f2159c5902
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          837341.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\837341.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 28ab5dad6d99d031cc77a73ac382720780f381f502148c0dd04bcd59d42082b2
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          938509.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\938509.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 15cc71954875768dcea48e48f60f18264fce473d84f37b20b99d207b77c91920
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          memory/1312-133-0x000000000D8F0000-0x000000000D9F0000-memory.dmp
                                                                                          Download

                                                                                          memory/3496-221-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1309-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1552-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-757-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1226-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1614-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1649-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1142-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-476-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4204-1094-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download