Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 19:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_693418edc4c62d9dda9811f8f8f10121_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-ylk3xstdlh
  • SHA256 1cdb877f1ad383f4f84bafa8290d20bd61b20b61a71831bbdba44a27e2c28e20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_693418edc4c62d9dda9811f8f8f10121_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_693418edc4c62d9dda9811f8f8f10121_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4112
    • C:\Users\Admin\AppData\Local\Temp\ypiohd.exe
      "C:\Users\Admin\AppData\Local\Temp\ypiohd.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\ypiohd.exe
        "C:\Users\Admin\AppData\Local\Temp\ypiohd.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1500
        • C:\Users\Admin\AppData\Roaming\Download\904766.exe
          "C:\Users\Admin\AppData\Roaming\Download\904766.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4276
          • C:\Users\Admin\AppData\Roaming\Download\904766.exe
            "C:\Users\Admin\AppData\Roaming\Download\904766.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4588
        • C:\Users\Admin\AppData\Roaming\Download\929475.exe
          "C:\Users\Admin\AppData\Roaming\Download\929475.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\Users\Admin\AppData\Roaming\Download\929475.exe
            "C:\Users\Admin\AppData\Roaming\Download\929475.exe"
            5⤵
            • Executes dropped EXE
            PID:3128
        • C:\Users\Admin\AppData\Roaming\Download\724800.exe
          "C:\Users\Admin\AppData\Roaming\Download\724800.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Users\Admin\AppData\Roaming\Download\724800.exe
            "C:\Users\Admin\AppData\Roaming\Download\724800.exe"
            5⤵
            • Executes dropped EXE
            PID:2028
        • C:\Users\Admin\AppData\Roaming\Download\573861.exe
          "C:\Users\Admin\AppData\Roaming\Download\573861.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6052
          • C:\Users\Admin\AppData\Roaming\Download\573861.exe
            "C:\Users\Admin\AppData\Roaming\Download\573861.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4752
        • C:\Users\Admin\AppData\Roaming\Download\587218.exe
          "C:\Users\Admin\AppData\Roaming\Download\587218.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3180
          • C:\Users\Admin\AppData\Roaming\Download\587218.exe
            "C:\Users\Admin\AppData\Roaming\Download\587218.exe"
            5⤵
            • Executes dropped EXE
            PID:456
        • C:\Users\Admin\AppData\Roaming\Download\310564.exe
          "C:\Users\Admin\AppData\Roaming\Download\310564.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5992
          • C:\Users\Admin\AppData\Roaming\Download\310564.exe
            "C:\Users\Admin\AppData\Roaming\Download\310564.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2408
        • C:\Users\Admin\AppData\Roaming\Download\400223.exe
          "C:\Users\Admin\AppData\Roaming\Download\400223.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:948
          • C:\Users\Admin\AppData\Roaming\Download\400223.exe
            "C:\Users\Admin\AppData\Roaming\Download\400223.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5324
        • C:\Users\Admin\AppData\Roaming\Download\697011.exe
          "C:\Users\Admin\AppData\Roaming\Download\697011.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5544
          • C:\Users\Admin\AppData\Roaming\Download\697011.exe
            "C:\Users\Admin\AppData\Roaming\Download\697011.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:456
        • C:\Users\Admin\AppData\Roaming\Download\535830.exe
          "C:\Users\Admin\AppData\Roaming\Download\535830.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5844
          • C:\Users\Admin\AppData\Roaming\Download\535830.exe
            "C:\Users\Admin\AppData\Roaming\Download\535830.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4392
        • C:\Users\Admin\AppData\Roaming\Download\065369.exe
          "C:\Users\Admin\AppData\Roaming\Download\065369.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5448
          • C:\Users\Admin\AppData\Roaming\Download\065369.exe
            "C:\Users\Admin\AppData\Roaming\Download\065369.exe"
            5⤵
            • Executes dropped EXE
            PID:5820
        • C:\Users\Admin\AppData\Roaming\Download\978500.exe
          "C:\Users\Admin\AppData\Roaming\Download\978500.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5592
          • C:\Users\Admin\AppData\Roaming\Download\978500.exe
            "C:\Users\Admin\AppData\Roaming\Download\978500.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5204
        • C:\Users\Admin\AppData\Roaming\Download\191876.exe
          "C:\Users\Admin\AppData\Roaming\Download\191876.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5608
          • C:\Users\Admin\AppData\Roaming\Download\191876.exe
            "C:\Users\Admin\AppData\Roaming\Download\191876.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2552
        • C:\Users\Admin\AppData\Roaming\Download\133132.exe
          "C:\Users\Admin\AppData\Roaming\Download\133132.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6020
          • C:\Users\Admin\AppData\Roaming\Download\133132.exe
            "C:\Users\Admin\AppData\Roaming\Download\133132.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5828
        • C:\Users\Admin\AppData\Roaming\Download\255298.exe
          "C:\Users\Admin\AppData\Roaming\Download\255298.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4308
          • C:\Users\Admin\AppData\Roaming\Download\255298.exe
            "C:\Users\Admin\AppData\Roaming\Download\255298.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4240
        • C:\Users\Admin\AppData\Roaming\Download\235822.exe
          "C:\Users\Admin\AppData\Roaming\Download\235822.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:960
          • C:\Users\Admin\AppData\Roaming\Download\235822.exe
            "C:\Users\Admin\AppData\Roaming\Download\235822.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4072
        • C:\Users\Admin\AppData\Roaming\Download\146373.exe
          "C:\Users\Admin\AppData\Roaming\Download\146373.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6044
          • C:\Users\Admin\AppData\Roaming\Download\146373.exe
            "C:\Users\Admin\AppData\Roaming\Download\146373.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:456
        • C:\Users\Admin\AppData\Roaming\Download\303171.exe
          "C:\Users\Admin\AppData\Roaming\Download\303171.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6132
          • C:\Users\Admin\AppData\Roaming\Download\303171.exe
            "C:\Users\Admin\AppData\Roaming\Download\303171.exe"
            5⤵
            • Executes dropped EXE
            PID:5240
        • C:\Users\Admin\AppData\Roaming\Download\181707.exe
          "C:\Users\Admin\AppData\Roaming\Download\181707.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5880
          • C:\Users\Admin\AppData\Roaming\Download\181707.exe
            "C:\Users\Admin\AppData\Roaming\Download\181707.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5984
        • C:\Users\Admin\AppData\Roaming\Download\772319.exe
          "C:\Users\Admin\AppData\Roaming\Download\772319.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4800
          • C:\Users\Admin\AppData\Roaming\Download\772319.exe
            "C:\Users\Admin\AppData\Roaming\Download\772319.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4132
        • C:\Users\Admin\AppData\Roaming\Download\579946.exe
          "C:\Users\Admin\AppData\Roaming\Download\579946.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4240
          • C:\Users\Admin\AppData\Roaming\Download\579946.exe
            "C:\Users\Admin\AppData\Roaming\Download\579946.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5464
        • C:\Users\Admin\AppData\Roaming\Download\592001.exe
          "C:\Users\Admin\AppData\Roaming\Download\592001.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5312
          • C:\Users\Admin\AppData\Roaming\Download\592001.exe
            "C:\Users\Admin\AppData\Roaming\Download\592001.exe"
            5⤵
            • Executes dropped EXE
            PID:5336
        • C:\Users\Admin\AppData\Roaming\Download\089029.exe
          "C:\Users\Admin\AppData\Roaming\Download\089029.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5964
          • C:\Users\Admin\AppData\Roaming\Download\089029.exe
            "C:\Users\Admin\AppData\Roaming\Download\089029.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5240
        • C:\Users\Admin\AppData\Roaming\Download\972340.exe
          "C:\Users\Admin\AppData\Roaming\Download\972340.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5800
          • C:\Users\Admin\AppData\Roaming\Download\972340.exe
            "C:\Users\Admin\AppData\Roaming\Download\972340.exe"
            5⤵
            • Executes dropped EXE
            PID:4184
        • C:\Users\Admin\AppData\Roaming\Download\018333.exe
          "C:\Users\Admin\AppData\Roaming\Download\018333.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4428
          • C:\Users\Admin\AppData\Roaming\Download\018333.exe
            "C:\Users\Admin\AppData\Roaming\Download\018333.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1448
        • C:\Users\Admin\AppData\Roaming\Download\585320.exe
          "C:\Users\Admin\AppData\Roaming\Download\585320.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5652
          • C:\Users\Admin\AppData\Roaming\Download\585320.exe
            "C:\Users\Admin\AppData\Roaming\Download\585320.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1396
        • C:\Users\Admin\AppData\Roaming\Download\631203.exe
          "C:\Users\Admin\AppData\Roaming\Download\631203.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6036
          • C:\Users\Admin\AppData\Roaming\Download\631203.exe
            "C:\Users\Admin\AppData\Roaming\Download\631203.exe"
            5⤵
            • Executes dropped EXE
            PID:6112
        • C:\Users\Admin\AppData\Roaming\Download\132832.exe
          "C:\Users\Admin\AppData\Roaming\Download\132832.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5564
          • C:\Users\Admin\AppData\Roaming\Download\132832.exe
            "C:\Users\Admin\AppData\Roaming\Download\132832.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5324
        • C:\Users\Admin\AppData\Roaming\Download\388714.exe
          "C:\Users\Admin\AppData\Roaming\Download\388714.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5268
          • C:\Users\Admin\AppData\Roaming\Download\388714.exe
            "C:\Users\Admin\AppData\Roaming\Download\388714.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1512
        • C:\Users\Admin\AppData\Roaming\Download\461265.exe
          "C:\Users\Admin\AppData\Roaming\Download\461265.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5348
          • C:\Users\Admin\AppData\Roaming\Download\461265.exe
            "C:\Users\Admin\AppData\Roaming\Download\461265.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5432
        • C:\Users\Admin\AppData\Roaming\Download\860979.exe
          "C:\Users\Admin\AppData\Roaming\Download\860979.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3404
          • C:\Users\Admin\AppData\Roaming\Download\860979.exe
            "C:\Users\Admin\AppData\Roaming\Download\860979.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4204
        • C:\Users\Admin\AppData\Roaming\Download\802235.exe
          "C:\Users\Admin\AppData\Roaming\Download\802235.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5932
          • C:\Users\Admin\AppData\Roaming\Download\802235.exe
            "C:\Users\Admin\AppData\Roaming\Download\802235.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5820
        • C:\Users\Admin\AppData\Roaming\Download\027301.exe
          "C:\Users\Admin\AppData\Roaming\Download\027301.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5664
          • C:\Users\Admin\AppData\Roaming\Download\027301.exe
            "C:\Users\Admin\AppData\Roaming\Download\027301.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5572
        • C:\Users\Admin\AppData\Roaming\Download\908752.exe
          "C:\Users\Admin\AppData\Roaming\Download\908752.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3172
          • C:\Users\Admin\AppData\Roaming\Download\908752.exe
            "C:\Users\Admin\AppData\Roaming\Download\908752.exe"
            5⤵
              PID:2544
          • C:\Users\Admin\AppData\Roaming\Download\295549.exe
            "C:\Users\Admin\AppData\Roaming\Download\295549.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:1252
            • C:\Users\Admin\AppData\Roaming\Download\295549.exe
              "C:\Users\Admin\AppData\Roaming\Download\295549.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5600
          • C:\Users\Admin\AppData\Roaming\Download\273174.exe
            "C:\Users\Admin\AppData\Roaming\Download\273174.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:3856
            • C:\Users\Admin\AppData\Roaming\Download\273174.exe
              "C:\Users\Admin\AppData\Roaming\Download\273174.exe"
              5⤵
                PID:5912
            • C:\Users\Admin\AppData\Roaming\Download\072708.exe
              "C:\Users\Admin\AppData\Roaming\Download\072708.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:5456
              • C:\Users\Admin\AppData\Roaming\Download\072708.exe
                "C:\Users\Admin\AppData\Roaming\Download\072708.exe"
                5⤵
                  PID:1200
              • C:\Users\Admin\AppData\Roaming\Download\247506.exe
                "C:\Users\Admin\AppData\Roaming\Download\247506.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:5536
                • C:\Users\Admin\AppData\Roaming\Download\247506.exe
                  "C:\Users\Admin\AppData\Roaming\Download\247506.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4264
              • C:\Users\Admin\AppData\Roaming\Download\340046.exe
                "C:\Users\Admin\AppData\Roaming\Download\340046.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3612
                • C:\Users\Admin\AppData\Roaming\Download\340046.exe
                  "C:\Users\Admin\AppData\Roaming\Download\340046.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:936
              • C:\Users\Admin\AppData\Roaming\Download\870576.exe
                "C:\Users\Admin\AppData\Roaming\Download\870576.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:5692
                • C:\Users\Admin\AppData\Roaming\Download\870576.exe
                  "C:\Users\Admin\AppData\Roaming\Download\870576.exe"
                  5⤵
                    PID:5616
                • C:\Users\Admin\AppData\Roaming\Download\519295.exe
                  "C:\Users\Admin\AppData\Roaming\Download\519295.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  PID:1556
                  • C:\Users\Admin\AppData\Roaming\Download\519295.exe
                    "C:\Users\Admin\AppData\Roaming\Download\519295.exe"
                    5⤵
                      PID:5576
                  • C:\Users\Admin\AppData\Roaming\Download\531351.exe
                    "C:\Users\Admin\AppData\Roaming\Download\531351.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:4160
                    • C:\Users\Admin\AppData\Roaming\Download\531351.exe
                      "C:\Users\Admin\AppData\Roaming\Download\531351.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1512
                  • C:\Users\Admin\AppData\Roaming\Download\784617.exe
                    "C:\Users\Admin\AppData\Roaming\Download\784617.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:5432
                    • C:\Users\Admin\AppData\Roaming\Download\784617.exe
                      "C:\Users\Admin\AppData\Roaming\Download\784617.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4652
                  • C:\Users\Admin\AppData\Roaming\Download\553243.exe
                    "C:\Users\Admin\AppData\Roaming\Download\553243.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:4540
                    • C:\Users\Admin\AppData\Roaming\Download\553243.exe
                      "C:\Users\Admin\AppData\Roaming\Download\553243.exe"
                      5⤵
                        PID:3012
                    • C:\Users\Admin\AppData\Roaming\Download\686319.exe
                      "C:\Users\Admin\AppData\Roaming\Download\686319.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:3508
                      • C:\Users\Admin\AppData\Roaming\Download\686319.exe
                        "C:\Users\Admin\AppData\Roaming\Download\686319.exe"
                        5⤵
                          PID:1376
                      • C:\Users\Admin\AppData\Roaming\Download\828695.exe
                        "C:\Users\Admin\AppData\Roaming\Download\828695.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        PID:6056
                        • C:\Users\Admin\AppData\Roaming\Download\828695.exe
                          "C:\Users\Admin\AppData\Roaming\Download\828695.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:936
                      • C:\Users\Admin\AppData\Roaming\Download\095482.exe
                        "C:\Users\Admin\AppData\Roaming\Download\095482.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        PID:2064
                        • C:\Users\Admin\AppData\Roaming\Download\095482.exe
                          "C:\Users\Admin\AppData\Roaming\Download\095482.exe"
                          5⤵
                            PID:2448
                        • C:\Users\Admin\AppData\Roaming\Download\996933.exe
                          "C:\Users\Admin\AppData\Roaming\Download\996933.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          PID:3936
                          • C:\Users\Admin\AppData\Roaming\Download\996933.exe
                            "C:\Users\Admin\AppData\Roaming\Download\996933.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:5620
                        • C:\Users\Admin\AppData\Roaming\Download\484731.exe
                          "C:\Users\Admin\AppData\Roaming\Download\484731.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:2372
                          • C:\Users\Admin\AppData\Roaming\Download\484731.exe
                            "C:\Users\Admin\AppData\Roaming\Download\484731.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:5532
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                      2⤵
                      • Drops file in Program Files directory
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies registry class
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:220
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbb82bc188,0x7ffbb82bc194,0x7ffbb82bc1a0
                        3⤵
                          PID:1972
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10689191787749466026,17861912035875673696,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
                          3⤵
                          • System Time Discovery
                          PID:464
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,12705627718802677151,3791874948027350871,262144 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
                          3⤵
                            PID:764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,9280886447131636908,14496833701751891257,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
                            3⤵
                              PID:4004
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8623426314045311008,15436183216733841650,2097152 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                              3⤵
                                PID:4664
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,323142583398462396,9451670738792015490,2097152 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
                                3⤵
                                  PID:5080
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8793203559232469412,13441161933006477854,2097152 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
                                  3⤵
                                    PID:3824
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,6628590566716461519,15924527361660975895,2097152 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
                                    3⤵
                                      PID:1900
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7132753831544648280,9209803817585894810,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
                                      3⤵
                                        PID:3932
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,9631670490639508196,14686499186601006300,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
                                        3⤵
                                          PID:3216
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5488,i,2522063131511059192,16914863268990610932,2097152 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
                                          3⤵
                                            PID:2800
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,3026922152474749036,18201326761818216114,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
                                            3⤵
                                              PID:3368
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,10657578195560821190,4634991833146252596,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
                                              3⤵
                                                PID:4984
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9039434238543164681,14623246291320120086,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
                                                3⤵
                                                • Modifies registry class
                                                PID:5496
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,671297341433268466,16483760941994593707,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
                                                3⤵
                                                  PID:5504
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11726457172159081131,1306440361760122400,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
                                                  3⤵
                                                    PID:3292
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11726457172159081131,1306440361760122400,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
                                                    3⤵
                                                      PID:540
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,13246648015576474170,4926484616074260048,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
                                                      3⤵
                                                        PID:5928
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7637430848866233627,10902548278971651250,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
                                                        3⤵
                                                          PID:5988
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6368,i,10097323400642507414,17411695473387250131,2097152 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
                                                          3⤵
                                                            PID:5280
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,13911298097202310545,14832515236861208452,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
                                                            3⤵
                                                              PID:5328
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12404198849475565520,12927462822459693878,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
                                                              3⤵
                                                                PID:5488
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,17153213471471938469,1386145516925901346,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
                                                                3⤵
                                                                  PID:5484
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,15043168969245528500,573338537043986599,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
                                                                  3⤵
                                                                    PID:5480
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,14279914511759513965,10603466707956733789,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
                                                                    3⤵
                                                                      PID:5260
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,17498581563554780170,15755299125407221129,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
                                                                      3⤵
                                                                        PID:3460
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,5345288525293272270,14954386890195718107,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
                                                                        3⤵
                                                                          PID:6104
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,8396076019326846377,14101424615250336050,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
                                                                          3⤵
                                                                            PID:4268
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,6049670538073140360,12872238331092342241,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:8
                                                                            3⤵
                                                                              PID:5580
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,177973590879190398,14651122046660912678,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
                                                                              3⤵
                                                                                PID:4728
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,11157080975436257835,1842558773519247672,262144 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
                                                                                3⤵
                                                                                  PID:5584
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,8097767055985674899,17419838040424282316,524288 --field-trial-handle=2328,i,15576805238237969021,2586763176433120843,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
                                                                                  3⤵
                                                                                    PID:6112
                                                                                • C:\Windows\explorer.exe
                                                                                  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                  2⤵
                                                                                    PID:1408
                                                                                • C:\Windows\explorer.exe
                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                  1⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3144
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                    2⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:2168
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:4448
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                    1⤵
                                                                                      PID:3128

                                                                                    Network

                                                                                          MITRE ATT&CK Enterprise v16

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          DouTuDaShi.exe
                                                                                          • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                          • Size 1.1MB
                                                                                          • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_1612728882\manifest.json
                                                                                          • Size 43B
                                                                                          • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_2129182631\manifest.json
                                                                                          • Size 165B
                                                                                          • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_719457602\manifest.json
                                                                                          • Size 160B
                                                                                          • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          manifest.json
                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_793910628\manifest.json
                                                                                          • Size 135B
                                                                                          • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          protocols.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                          • Size 3KB
                                                                                          • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 a514f5f8b7f78bdebc35d3a74dcd3f72d6b8dab51ae4ecb75bfd60a99ad7ea92
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index~RFe594201.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594201.TMP
                                                                                          • Size 3KB
                                                                                          • SHA256 a68a1fa170235a27857ee79c8a8382e596a111645287acab94525c0630c903e7
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          Edge Profile.ico
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                          • Size 70KB
                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          CURRENT
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
                                                                                          • Size 16B
                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          MANIFEST-000001
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
                                                                                          • Size 41B
                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 111B
                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 6KB
                                                                                          • SHA256 29180547e688ce4142c489aa3971506b9ade5fffd71d99c40deb7a7d400bdff7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          SCT Auditing Pending Reports
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                          • Size 2B
                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 10KB
                                                                                          • SHA256 fe72451cd3a410fb5aba4dbc38b5cbdb0bdfa38cf63c9428dfc95da8e6a01b99
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 11KB
                                                                                          • SHA256 100347d6a9db4b316346439fd281f89697c6c65039333f2d969a5a34b4ca339e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 11KB
                                                                                          • SHA256 343ccb266c98827eda32363092bb34cfc221b3b2fc9a9ca8361fc71072765c34
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Secure Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                          • Size 27KB
                                                                                          • SHA256 59124d322d9ffc08f9d1755f1bf0a89b56722f65c153e604de8622b50b014ec9
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          OperationConfig
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                          • Size 22KB
                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          OperationConfig~RFe597219.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597219.TMP
                                                                                          • Size 3KB
                                                                                          • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          office_endpoints_list.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                          • Size 9KB
                                                                                          • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 3ea79984a807dfe55be4e6bb09b561c1c8e5e443b473ac93e23e7967caa24ae5
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 12KB
                                                                                          • SHA256 83280506db90cbae9d466281ea6c754c0ec7052c1339eacccda860cd03819612
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 23KB
                                                                                          • SHA256 4e74a2fe560dba8a943d13574ec66228a6cc5455dde63fee807b02443e632446
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 18KB
                                                                                          • SHA256 06ba109d786ea174a2a46a77c7c12938d6a1a418452a479069ccc4059d24844e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 8472ab76ad9b1fdcfc9a75f370afdd047e859c76cf9f473ca1933025a208c4ba
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 18KB
                                                                                          • SHA256 74a2a0dc0bb82256dc99ecb6c2711d2bf460da7ec51b63be953e61232ca27c11
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          nav_config.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                          • Size 2KB
                                                                                          • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 252B
                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 372B
                                                                                          • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                          • Size 132B
                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                          • Size 13B
                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          hao.360[1].xml
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LLV7S1BP\hao.360[1].xml
                                                                                          • Size 50KB
                                                                                          • SHA256 da207f0cb1c9d8a1196807c51451342239b79394d16d2d1ad30f77fc8f5eadfc
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          hao.360[1].xml
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LLV7S1BP\hao.360[1].xml
                                                                                          • Size 55KB
                                                                                          • SHA256 2e533e36be14449d5a04dd75ebef00ad80a520353d5407c2ec25b5e361f88297
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Size 2KB
                                                                                          • SHA256 425ab7c0b0e6cc112f90ce8987cdc7556f054f76c08107f32da651da38bfc1de
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          113[1].js
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR6ZW6LX\113[1].js
                                                                                          • Size 61KB
                                                                                          • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          time[1].js
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR6ZW6LX\time[1].js
                                                                                          • Size 27B
                                                                                          • SHA256 d2d8f19d33f62e6446e8a4e29a1273361a6234834e8f3f7a70dd1ecfe21618f6
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          sed_api_weather_info[1].htm
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TY6HNOHQ\sed_api_weather_info[1].htm
                                                                                          • Size 8KB
                                                                                          • SHA256 87b254c51ae299741e72ad5a142bd12cc6fd523543f9ce18455f5b6f8f78205a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          9449f128-270e-4cb8-bc13-bc9bddd32648.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\9449f128-270e-4cb8-bc13-bc9bddd32648.tmp
                                                                                          • Size 10KB
                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f9259c1c-6c92-4de1-a070-a78c8895a3ef.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\f9259c1c-6c92-4de1-a070-a78c8895a3ef.tmp
                                                                                          • Size 1B
                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          ldsajdklsajdlkjsalkda.bat
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                          • Size 589B
                                                                                          • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          54d93fa4-44f6-4689-9f58-7c40ab8e7365.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir220_1634614141\54d93fa4-44f6-4689-9f58-7c40ab8e7365.tmp
                                                                                          • Size 157KB
                                                                                          • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          content_new.js
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir220_967186603\CRX_INSTALL\content_new.js
                                                                                          • Size 10KB
                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          ypiohd.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ypiohd.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 1cdb877f1ad383f4f84bafa8290d20bd61b20b61a71831bbdba44a27e2c28e20
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          065369.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\065369.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 30cce2446dba1866e8f0e4f16848972e1c8465f9283b386c21cd51c733b7c86f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          191876.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\191876.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 6327208e5bac35647512b4737154e458a1ae5df03e9c7170d2f6264213c8d832
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          310564.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\310564.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 8b2f63f3aaa384f53747a3b3df791019f1cb57c530c2bad87d1fa88594e78dea
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          400223.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\400223.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 2d6facdb62c603987943246649e8f749084e6bfb8a82675e815828357135987f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          535830.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\535830.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 5e891877a3531df37ce9ab44c5ce7e109553202e91db3f01ca15df9247edd5ff
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          573861.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\573861.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 0b7a1fe5d29d72cbf87067287ba28e0da0431bf91c31e358bec8851b855b0c31
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          587218.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\587218.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 62ae0eff01ca242cf43dbc05ffb7cf186df7fd1ec9bb0ef21c572fb4558da40d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          697011.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\697011.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 f45ca5b26b15f0158042a24b06ececa3306ff95f6a2d3aaea533936682b1f28d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          724800.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\724800.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 436a9ad86762b92311665e68435e2c69ee2fb0e369373fd7f374c715324df1b1
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          904766.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\904766.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 0ab4a17136e015f63c1ecede46c80659d099614509836f1191490825d3a10abe
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          929475.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\929475.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 9846592747fcc725940fe12d13ee7c2026028f6835d0f11bc719920a5780fdac
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          978500.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\978500.exe
                                                                                          • Size 1.5MB
                                                                                          • SHA256 5347d3ef477b1570f476c69bf4580e298f8a4608172e6e91ded83417f6ced11f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          memory/1276-23-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1525-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1471-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1568-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1420-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-372-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1624-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1021-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1678-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/1500-1713-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/2652-210-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                          Download

                                                                                          memory/4112-132-0x000000000EC50000-0x000000000ED50000-memory.dmp
                                                                                          Download

                                                                                          memory/4112-133-0x000000000EC50000-0x000000000ED50000-memory.dmp
                                                                                          Download