Overview

overview

7

Static

static

3

2026-09-30...op.exe

windows10-2004-x64

7

2026-09-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 13:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_17a9ecee12667047a828bc3fa76f57f5_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-qyd65ssdpg
  • SHA256 32ad59fcafb9a6d16e5ac4851b5f132ce7e8bdd79d73b218d77fde18339e9948
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_17a9ecee12667047a828bc3fa76f57f5_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_17a9ecee12667047a828bc3fa76f57f5_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:1852
    • C:\Users\Admin\AppData\Local\Temp\qmzlvj.exe
      "C:\Users\Admin\AppData\Local\Temp\qmzlvj.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5556
      • C:\Users\Admin\AppData\Local\Temp\qmzlvj.exe
        "C:\Users\Admin\AppData\Local\Temp\qmzlvj.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Users\Admin\AppData\Roaming\Download\190998.exe
          "C:\Users\Admin\AppData\Roaming\Download\190998.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5068
          • C:\Users\Admin\AppData\Roaming\Download\190998.exe
            "C:\Users\Admin\AppData\Roaming\Download\190998.exe"
            5⤵
            • Executes dropped EXE
            PID:4140
        • C:\Users\Admin\AppData\Roaming\Download\897967.exe
          "C:\Users\Admin\AppData\Roaming\Download\897967.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6132
          • C:\Users\Admin\AppData\Roaming\Download\897967.exe
            "C:\Users\Admin\AppData\Roaming\Download\897967.exe"
            5⤵
            • Executes dropped EXE
            PID:4836
        • C:\Users\Admin\AppData\Roaming\Download\388581.exe
          "C:\Users\Admin\AppData\Roaming\Download\388581.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3416
          • C:\Users\Admin\AppData\Roaming\Download\388581.exe
            "C:\Users\Admin\AppData\Roaming\Download\388581.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5628
        • C:\Users\Admin\AppData\Roaming\Download\882110.exe
          "C:\Users\Admin\AppData\Roaming\Download\882110.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5780
          • C:\Users\Admin\AppData\Roaming\Download\882110.exe
            "C:\Users\Admin\AppData\Roaming\Download\882110.exe"
            5⤵
            • Executes dropped EXE
            PID:4020
        • C:\Users\Admin\AppData\Roaming\Download\773361.exe
          "C:\Users\Admin\AppData\Roaming\Download\773361.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Users\Admin\AppData\Roaming\Download\773361.exe
            "C:\Users\Admin\AppData\Roaming\Download\773361.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2744
        • C:\Users\Admin\AppData\Roaming\Download\015627.exe
          "C:\Users\Admin\AppData\Roaming\Download\015627.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Users\Admin\AppData\Roaming\Download\015627.exe
            "C:\Users\Admin\AppData\Roaming\Download\015627.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5804
        • C:\Users\Admin\AppData\Roaming\Download\282414.exe
          "C:\Users\Admin\AppData\Roaming\Download\282414.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5540
          • C:\Users\Admin\AppData\Roaming\Download\282414.exe
            "C:\Users\Admin\AppData\Roaming\Download\282414.exe"
            5⤵
            • Executes dropped EXE
            PID:5516
        • C:\Users\Admin\AppData\Roaming\Download\397662.exe
          "C:\Users\Admin\AppData\Roaming\Download\397662.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5588
          • C:\Users\Admin\AppData\Roaming\Download\397662.exe
            "C:\Users\Admin\AppData\Roaming\Download\397662.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1932
        • C:\Users\Admin\AppData\Roaming\Download\790699.exe
          "C:\Users\Admin\AppData\Roaming\Download\790699.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5240
          • C:\Users\Admin\AppData\Roaming\Download\790699.exe
            "C:\Users\Admin\AppData\Roaming\Download\790699.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4456
        • C:\Users\Admin\AppData\Roaming\Download\456488.exe
          "C:\Users\Admin\AppData\Roaming\Download\456488.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5804
          • C:\Users\Admin\AppData\Roaming\Download\456488.exe
            "C:\Users\Admin\AppData\Roaming\Download\456488.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3096
        • C:\Users\Admin\AppData\Roaming\Download\613206.exe
          "C:\Users\Admin\AppData\Roaming\Download\613206.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4404
          • C:\Users\Admin\AppData\Roaming\Download\613206.exe
            "C:\Users\Admin\AppData\Roaming\Download\613206.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1340
        • C:\Users\Admin\AppData\Roaming\Download\666562.exe
          "C:\Users\Admin\AppData\Roaming\Download\666562.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Users\Admin\AppData\Roaming\Download\666562.exe
            "C:\Users\Admin\AppData\Roaming\Download\666562.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:992
        • C:\Users\Admin\AppData\Roaming\Download\980620.exe
          "C:\Users\Admin\AppData\Roaming\Download\980620.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3784
          • C:\Users\Admin\AppData\Roaming\Download\980620.exe
            "C:\Users\Admin\AppData\Roaming\Download\980620.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3256
        • C:\Users\Admin\AppData\Roaming\Download\922986.exe
          "C:\Users\Admin\AppData\Roaming\Download\922986.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5168
          • C:\Users\Admin\AppData\Roaming\Download\922986.exe
            "C:\Users\Admin\AppData\Roaming\Download\922986.exe"
            5⤵
            • Executes dropped EXE
            PID:1856
        • C:\Users\Admin\AppData\Roaming\Download\669605.exe
          "C:\Users\Admin\AppData\Roaming\Download\669605.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4564
          • C:\Users\Admin\AppData\Roaming\Download\669605.exe
            "C:\Users\Admin\AppData\Roaming\Download\669605.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5404
        • C:\Users\Admin\AppData\Roaming\Download\881761.exe
          "C:\Users\Admin\AppData\Roaming\Download\881761.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2672
          • C:\Users\Admin\AppData\Roaming\Download\881761.exe
            "C:\Users\Admin\AppData\Roaming\Download\881761.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3832
        • C:\Users\Admin\AppData\Roaming\Download\078768.exe
          "C:\Users\Admin\AppData\Roaming\Download\078768.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4476
          • C:\Users\Admin\AppData\Roaming\Download\078768.exe
            "C:\Users\Admin\AppData\Roaming\Download\078768.exe"
            5⤵
            • Executes dropped EXE
            PID:3992
        • C:\Users\Admin\AppData\Roaming\Download\858193.exe
          "C:\Users\Admin\AppData\Roaming\Download\858193.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1888
          • C:\Users\Admin\AppData\Roaming\Download\858193.exe
            "C:\Users\Admin\AppData\Roaming\Download\858193.exe"
            5⤵
            • Executes dropped EXE
            PID:2248
        • C:\Users\Admin\AppData\Roaming\Download\190458.exe
          "C:\Users\Admin\AppData\Roaming\Download\190458.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5312
          • C:\Users\Admin\AppData\Roaming\Download\190458.exe
            "C:\Users\Admin\AppData\Roaming\Download\190458.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5996
        • C:\Users\Admin\AppData\Roaming\Download\081909.exe
          "C:\Users\Admin\AppData\Roaming\Download\081909.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1480
          • C:\Users\Admin\AppData\Roaming\Download\081909.exe
            "C:\Users\Admin\AppData\Roaming\Download\081909.exe"
            5⤵
            • Executes dropped EXE
            PID:3780
        • C:\Users\Admin\AppData\Roaming\Download\165882.exe
          "C:\Users\Admin\AppData\Roaming\Download\165882.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4600
          • C:\Users\Admin\AppData\Roaming\Download\165882.exe
            "C:\Users\Admin\AppData\Roaming\Download\165882.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4468
        • C:\Users\Admin\AppData\Roaming\Download\388168.exe
          "C:\Users\Admin\AppData\Roaming\Download\388168.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5484
          • C:\Users\Admin\AppData\Roaming\Download\388168.exe
            "C:\Users\Admin\AppData\Roaming\Download\388168.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4752
        • C:\Users\Admin\AppData\Roaming\Download\168792.exe
          "C:\Users\Admin\AppData\Roaming\Download\168792.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5512
          • C:\Users\Admin\AppData\Roaming\Download\168792.exe
            "C:\Users\Admin\AppData\Roaming\Download\168792.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3496
        • C:\Users\Admin\AppData\Roaming\Download\100858.exe
          "C:\Users\Admin\AppData\Roaming\Download\100858.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3700
          • C:\Users\Admin\AppData\Roaming\Download\100858.exe
            "C:\Users\Admin\AppData\Roaming\Download\100858.exe"
            5⤵
            • Executes dropped EXE
            PID:4948
        • C:\Users\Admin\AppData\Roaming\Download\988483.exe
          "C:\Users\Admin\AppData\Roaming\Download\988483.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4028
          • C:\Users\Admin\AppData\Roaming\Download\988483.exe
            "C:\Users\Admin\AppData\Roaming\Download\988483.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6116
        • C:\Users\Admin\AppData\Roaming\Download\333365.exe
          "C:\Users\Admin\AppData\Roaming\Download\333365.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5384
          • C:\Users\Admin\AppData\Roaming\Download\333365.exe
            "C:\Users\Admin\AppData\Roaming\Download\333365.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2416
        • C:\Users\Admin\AppData\Roaming\Download\356631.exe
          "C:\Users\Admin\AppData\Roaming\Download\356631.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1248
          • C:\Users\Admin\AppData\Roaming\Download\356631.exe
            "C:\Users\Admin\AppData\Roaming\Download\356631.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3964
        • C:\Users\Admin\AppData\Roaming\Download\390797.exe
          "C:\Users\Admin\AppData\Roaming\Download\390797.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1416
          • C:\Users\Admin\AppData\Roaming\Download\390797.exe
            "C:\Users\Admin\AppData\Roaming\Download\390797.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2844
        • C:\Users\Admin\AppData\Roaming\Download\726970.exe
          "C:\Users\Admin\AppData\Roaming\Download\726970.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4632
          • C:\Users\Admin\AppData\Roaming\Download\726970.exe
            "C:\Users\Admin\AppData\Roaming\Download\726970.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6044
        • C:\Users\Admin\AppData\Roaming\Download\627220.exe
          "C:\Users\Admin\AppData\Roaming\Download\627220.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5768
          • C:\Users\Admin\AppData\Roaming\Download\627220.exe
            "C:\Users\Admin\AppData\Roaming\Download\627220.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3040
        • C:\Users\Admin\AppData\Roaming\Download\650586.exe
          "C:\Users\Admin\AppData\Roaming\Download\650586.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3096
          • C:\Users\Admin\AppData\Roaming\Download\650586.exe
            "C:\Users\Admin\AppData\Roaming\Download\650586.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:376
        • C:\Users\Admin\AppData\Roaming\Download\137374.exe
          "C:\Users\Admin\AppData\Roaming\Download\137374.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5036
          • C:\Users\Admin\AppData\Roaming\Download\137374.exe
            "C:\Users\Admin\AppData\Roaming\Download\137374.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5764
        • C:\Users\Admin\AppData\Roaming\Download\169542.exe
          "C:\Users\Admin\AppData\Roaming\Download\169542.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:5672
          • C:\Users\Admin\AppData\Roaming\Download\169542.exe
            "C:\Users\Admin\AppData\Roaming\Download\169542.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4032
        • C:\Users\Admin\AppData\Roaming\Download\102608.exe
          "C:\Users\Admin\AppData\Roaming\Download\102608.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:2060
          • C:\Users\Admin\AppData\Roaming\Download\102608.exe
            "C:\Users\Admin\AppData\Roaming\Download\102608.exe"
            5⤵
              PID:4380
          • C:\Users\Admin\AppData\Roaming\Download\337888.exe
            "C:\Users\Admin\AppData\Roaming\Download\337888.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:4840
            • C:\Users\Admin\AppData\Roaming\Download\337888.exe
              "C:\Users\Admin\AppData\Roaming\Download\337888.exe"
              5⤵
                PID:5708
            • C:\Users\Admin\AppData\Roaming\Download\683861.exe
              "C:\Users\Admin\AppData\Roaming\Download\683861.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5472
              • C:\Users\Admin\AppData\Roaming\Download\683861.exe
                "C:\Users\Admin\AppData\Roaming\Download\683861.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:912
            • C:\Users\Admin\AppData\Roaming\Download\566212.exe
              "C:\Users\Admin\AppData\Roaming\Download\566212.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:6084
              • C:\Users\Admin\AppData\Roaming\Download\566212.exe
                "C:\Users\Admin\AppData\Roaming\Download\566212.exe"
                5⤵
                  PID:3244
              • C:\Users\Admin\AppData\Roaming\Download\509378.exe
                "C:\Users\Admin\AppData\Roaming\Download\509378.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:1136
                • C:\Users\Admin\AppData\Roaming\Download\509378.exe
                  "C:\Users\Admin\AppData\Roaming\Download\509378.exe"
                  5⤵
                    PID:4148
                • C:\Users\Admin\AppData\Roaming\Download\586904.exe
                  "C:\Users\Admin\AppData\Roaming\Download\586904.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:3344
                  • C:\Users\Admin\AppData\Roaming\Download\586904.exe
                    "C:\Users\Admin\AppData\Roaming\Download\586904.exe"
                    5⤵
                      PID:4468
                  • C:\Users\Admin\AppData\Roaming\Download\609260.exe
                    "C:\Users\Admin\AppData\Roaming\Download\609260.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:5216
                    • C:\Users\Admin\AppData\Roaming\Download\609260.exe
                      "C:\Users\Admin\AppData\Roaming\Download\609260.exe"
                      5⤵
                        PID:4928
                    • C:\Users\Admin\AppData\Roaming\Download\651336.exe
                      "C:\Users\Admin\AppData\Roaming\Download\651336.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:2152
                      • C:\Users\Admin\AppData\Roaming\Download\651336.exe
                        "C:\Users\Admin\AppData\Roaming\Download\651336.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5372
                    • C:\Users\Admin\AppData\Roaming\Download\242040.exe
                      "C:\Users\Admin\AppData\Roaming\Download\242040.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:4808
                      • C:\Users\Admin\AppData\Roaming\Download\242040.exe
                        "C:\Users\Admin\AppData\Roaming\Download\242040.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:3800
                    • C:\Users\Admin\AppData\Roaming\Download\123591.exe
                      "C:\Users\Admin\AppData\Roaming\Download\123591.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:3244
                      • C:\Users\Admin\AppData\Roaming\Download\123591.exe
                        "C:\Users\Admin\AppData\Roaming\Download\123591.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5964
                    • C:\Users\Admin\AppData\Roaming\Download\310389.exe
                      "C:\Users\Admin\AppData\Roaming\Download\310389.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:3176
                      • C:\Users\Admin\AppData\Roaming\Download\310389.exe
                        "C:\Users\Admin\AppData\Roaming\Download\310389.exe"
                        5⤵
                          PID:2416
                      • C:\Users\Admin\AppData\Roaming\Download\532654.exe
                        "C:\Users\Admin\AppData\Roaming\Download\532654.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        PID:1488
                        • C:\Users\Admin\AppData\Roaming\Download\532654.exe
                          "C:\Users\Admin\AppData\Roaming\Download\532654.exe"
                          5⤵
                            PID:4316
                        • C:\Users\Admin\AppData\Roaming\Download\891442.exe
                          "C:\Users\Admin\AppData\Roaming\Download\891442.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:2216
                          • C:\Users\Admin\AppData\Roaming\Download\891442.exe
                            "C:\Users\Admin\AppData\Roaming\Download\891442.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4984
                        • C:\Users\Admin\AppData\Roaming\Download\836718.exe
                          "C:\Users\Admin\AppData\Roaming\Download\836718.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          PID:1644
                          • C:\Users\Admin\AppData\Roaming\Download\836718.exe
                            "C:\Users\Admin\AppData\Roaming\Download\836718.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:5244
                        • C:\Users\Admin\AppData\Roaming\Download\062790.exe
                          "C:\Users\Admin\AppData\Roaming\Download\062790.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:4464
                          • C:\Users\Admin\AppData\Roaming\Download\062790.exe
                            "C:\Users\Admin\AppData\Roaming\Download\062790.exe"
                            5⤵
                              PID:1048
                          • C:\Users\Admin\AppData\Roaming\Download\317673.exe
                            "C:\Users\Admin\AppData\Roaming\Download\317673.exe" /Shorttailedrestart
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5860
                            • C:\Users\Admin\AppData\Roaming\Download\317673.exe
                              "C:\Users\Admin\AppData\Roaming\Download\317673.exe"
                              5⤵
                                PID:6036
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                          2⤵
                          • Drops file in Program Files directory
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:1508
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffdb3b7c188,0x7ffdb3b7c194,0x7ffdb3b7c1a0
                            3⤵
                              PID:1308
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,9011058005037348236,18194063727421801308,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
                              3⤵
                              • System Time Discovery
                              PID:5180
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,4236814378401457343,9614775969400400441,262144 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
                              3⤵
                                PID:2028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,4771778352507264855,9181964725325707523,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
                                3⤵
                                  PID:4492
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10554665598740927385,14680653320945931519,2097152 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                                  3⤵
                                    PID:1680
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15812339958326209845,6028075350969255861,2097152 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
                                    3⤵
                                      PID:5820
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1528,i,1786516308299392965,1757717905938846517,2097152 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
                                      3⤵
                                        PID:2192
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,593396440759751835,12189215215763439448,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
                                        3⤵
                                        • Modifies registry class
                                        PID:2616
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17223501182599008582,14135261538352758523,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
                                        3⤵
                                          PID:3760
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5372,i,17209520721084638072,10403077815591618312,2097152 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
                                          3⤵
                                            PID:5944
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,14256152425793166561,1477668888364596726,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
                                            3⤵
                                              PID:5220
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,110987601662928372,11376995822022656342,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
                                              3⤵
                                                PID:3044
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,17888431430435616419,6092296182645407761,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
                                                3⤵
                                                  PID:5980
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,17888431430435616419,6092296182645407761,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
                                                  3⤵
                                                    PID:2936
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,3490609700831980533,1419676583835859413,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
                                                    3⤵
                                                      PID:2208
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,2392823891291023341,4727443291019187687,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
                                                      3⤵
                                                        PID:3780
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,9403132088857136609,5206567707728663089,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
                                                        3⤵
                                                          PID:4564
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,902795179568167629,653264522698730082,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
                                                          3⤵
                                                            PID:3240
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,3347080547950644336,11576783413920805695,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
                                                            3⤵
                                                              PID:2664
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,9796214355653761286,3000416699183664529,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
                                                              3⤵
                                                                PID:1500
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,1169542801059388160,13837297198534371736,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
                                                                3⤵
                                                                  PID:5568
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5864,i,11758380959686404699,12075683630720076079,262144 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
                                                                  3⤵
                                                                    PID:3932
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,6540581856866280945,9894664210103469535,524288 --field-trial-handle=2392,i,419307922257227005,15354312884108174933,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
                                                                    3⤵
                                                                      PID:4608
                                                                  • C:\Windows\explorer.exe
                                                                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                    2⤵
                                                                      PID:2084
                                                                  • C:\Windows\explorer.exe
                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                    1⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4952
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:3532
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                    1⤵
                                                                      PID:1968
                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                      1⤵
                                                                        PID:3532
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                        1⤵
                                                                          PID:2336

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              DouTuDaShi.exe
                                                                              • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                              • Size 1.1MB
                                                                              • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              manifest.json
                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1508_1445181916\manifest.json
                                                                              • Size 118B
                                                                              • SHA256 3f89d5f63524c77efb5facb385319a03aee54129aa22bca5f6061b8654f7bc5b
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              manifest.json
                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1508_2041067289\manifest.json
                                                                              • Size 53B
                                                                              • SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              deny_domains.list
                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1508_811690688\deny_domains.list
                                                                              • Size 12B
                                                                              • SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              manifest.json
                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1508_811690688\manifest.json
                                                                              • Size 177B
                                                                              • SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              8e2d44f6-6e04-49aa-89b0-a06f85366e86.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e2d44f6-6e04-49aa-89b0-a06f85366e86.tmp
                                                                              • Size 26KB
                                                                              • SHA256 215072a3b388fe1b3d53dea759f52aefeb962b4f569563ad2293597c2801caba
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              2ea908b5-d6f0-4e44-b7d2-c45fc553fb2a.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ea908b5-d6f0-4e44-b7d2-c45fc553fb2a.tmp
                                                                              • Size 32KB
                                                                              • SHA256 81a59063470f7a0973b343f14e682f3b3160306aacc684651d012de9049f33e7
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              BookmarkMergedSurfaceOrdering
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                              • Size 6B
                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BrowsingTopicsState
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                              • Size 649B
                                                                              • SHA256 69595c9f4788eb49e7b552500fdc36911dca9f512f8e0e16f88c13e3932f4752
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                              • Size 4KB
                                                                              • SHA256 a72bdc12da9f8a58999d098ad28805f92e9e259e003035f641dbf0da0a742963
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                              • Size 4KB
                                                                              • SHA256 3b4aafd39723a766e0315bbb51760a5c190ac5d1e339bc47649539052aac23bd
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              the-real-index~RFe596c1e.TMP
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596c1e.TMP
                                                                              • Size 3KB
                                                                              • SHA256 cb154216dea078cdf43ee7de960433d03714f6299902f69e7ffb07275378ecc0
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              SiteList-Enterprise.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                              • Size 2B
                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                              • Size 6KB
                                                                              • SHA256 3ae9590c225bff14ae7a6646744324d6f06f736371c162be20283e61cac5f2fb
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              SCT Auditing Pending Reports
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                              • Size 2B
                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Sdch Dictionaries
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                              • Size 40B
                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 ba73df962ea5b2e578acb0172be7cfd95eb13c9e5636171917f0de997f2fb011
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 13KB
                                                                              • SHA256 53b3829cc8903d4449bce3bab9e393779f19812f64d35060c4bef25919395e15
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 12KB
                                                                              • SHA256 2107f5c0ad7a6930b5e8c803749b35ad7c63c04991081b2794d552983927491e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              sync_diagnostic.log
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                              • Size 23KB
                                                                              • SHA256 ff0dc16194098ff7b1e31d35a81482f290d7e8e8be39b9924022ba04e2991837
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              data.txt
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
                                                                              • Size 152KB
                                                                              • SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 25KB
                                                                              • SHA256 f2852c949abea301083d49d0bae462830a0138fcfe741464b1d7888b759ec4b5
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 25KB
                                                                              • SHA256 dee3501d5d25e4894fefafc0353ccd92f38b059030af80386357da825b7a3b2d
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 26KB
                                                                              • SHA256 43912d70d7ee70dcfb3c34a52755e0172c65a125a1a9c8a77175e281f7d73616
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              typosquatting_list.pb
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.30.1\typosquatting_list.pb
                                                                              • Size 1.4MB
                                                                              • SHA256 5435d91bee48abb353a7d203b4b7eecac6d2901a96fd0c934fcc8ecf173e5563
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 2KB
                                                                              • SHA256 d877e0584d1fc9dbf825ea2796df60571c9505eae4b981310980927733ece8a0
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 2KB
                                                                              • SHA256 940a510622c25c765e1fd24ab9974f9f06045d9aaa243c831834f72722195066
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 2KB
                                                                              • SHA256 7d4f20940210f8354e9aa816ff9780edca52ec3dac83fdaef247a33377a3fd9d
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              hao.360[1].xml
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1UIRFA2D\hao.360[1].xml
                                                                              • Size 666B
                                                                              • SHA256 83478c01660a7553389702dd68d4e29e1516239bb8f719a9db6a338dd971ecc3
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              hao.360[1].xml
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1UIRFA2D\hao.360[1].xml
                                                                              • Size 2KB
                                                                              • SHA256 c25c0db8eef78e83547b497221c68563e3681b5e7170c8319c2e1861c033c30c
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              hao.360[1].xml
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1UIRFA2D\hao.360[1].xml
                                                                              • Size 50KB
                                                                              • SHA256 a104b75b475771e55c590d343f0ac942209a5037da9bfd9235edb9adb4060a5b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              hao.360[1].xml
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1UIRFA2D\hao.360[1].xml
                                                                              • Size 55KB
                                                                              • SHA256 fa73f3b121ea469e897f68440a8706ebf96a070c919c5d29fffdc018f33ab932
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                              • Size 2KB
                                                                              • SHA256 689ef6959427f2415afe1778472b1072729ccc478a7f11aa1e332b3884ffdbbd
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              sed_api_weather_info[1].htm
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\sed_api_weather_info[1].htm
                                                                              • Size 8KB
                                                                              • SHA256 91d0de370c0145417403f62ea25b73fb837e7ff63464438ac4951d86bf012625
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              time[1].js
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\time[1].js
                                                                              • Size 27B
                                                                              • SHA256 c66495e830f73388b3599b06b185404e49caa39c8b14be185a6ae357cd21001e
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              113[1].js
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UN11FRGI\113[1].js
                                                                              • Size 61KB
                                                                              • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              0[1].png
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8OSE262\0[1].png
                                                                              • Size 574B
                                                                              • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              ldsajdklsajdlkjsalkda.bat
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                              • Size 589B
                                                                              • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              qmzlvj.exe
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\qmzlvj.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 32ad59fcafb9a6d16e5ac4851b5f132ce7e8bdd79d73b218d77fde18339e9948
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              015627.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\015627.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 4f3a3a678a621c27d4a297ade501f7b7a4543b3b426277297ff78de0fe5deda1
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              190998.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\190998.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 078928eff698e69f364197ea339e13d19110a67f4666eb8c35e78ff2654d5a4c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              282414.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\282414.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 692040e6a903681114ce48a3a0e951f89b8d61afb9c6e4b881b0fac32c272d5a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              388581.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\388581.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 ed735544e42f2267b7b02158fefd502f28e4a4420cd107f4b2aef425dc129329
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              397662.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\397662.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 819a2bef3e026ad9faef6cb834aee170433a1af37e9bcf3bbb93040e56969fda
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              456488.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\456488.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 6860ccac35265b9048aa993b1632a1ec2e50b7b25ba463d6c749a7e3ef68e394
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              613206.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\613206.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 23910c0fa81f911b24e225dba54571d9b8ed51d56d3d53852a0506b66b88e314
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              666562.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\666562.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 7453f16ca33a3e339a4439957f38985fdfd542fc50c47e6ebc32925e6eb7bb9b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              669605.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\669605.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 0573a52d802f4fe7ed3d893c4ba3b865c26c516c3b0cf5060fad39c94766fc07
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              773361.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\773361.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 797bcdb1acb7c291b762328651505c0af63c58537446b4934d968e5bd4a59dd0
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              790699.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\790699.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 511f616bbaa22dfef9cb6149924f871e31c40b9f648583e36ac2e6ba0b15f200
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              882110.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\882110.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 ad9592f8803424b3da89c275660694d5c7c41e78679854daa9a4aac6cff10939
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              897967.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\897967.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 63bbe1d64947d94a43bc8d47c6bae4e7621c069c07cb276f2dc1aa976b942a1f
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              922986.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\922986.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 0a3f4eba9ce501f44a1f696dd3a6d08fdaadce54437200fd231fa6fef277c92a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              980620.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\980620.exe
                                                                              • Size 1.5MB
                                                                              • SHA256 cc83c73cee6f24d325a2ab7e6fbfa9af7108e64f640a4d69916e905cb7eb0ed5
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              memory/1692-250-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-991-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1232-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1183-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1119-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1277-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1071-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1343-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1379-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1026-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-916-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-1424-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download

                                                                              memory/4532-313-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                              Download