Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/l...

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    390s
  • max time network
    378s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    21/02/2026, 23:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/loneicewolf/Stuxnet-Source/raw/refs/heads/ONLY_MALWARE/00000000AltDuqDrop.dll.7z
  • Sample260221-3ck4sagt4e
Score
10/10
adwarebackdoordiscoverystuxnetpersistenceransomwarespyware

Malware Config

Signatures

  • Detects Stuxnet 1 IoCs
    backdoor
  • Stuxnet

    Stuxnet is a backdoor written in C++.

    backdoorstuxnet
  • Stuxnet family
    stuxnet
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 31 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/loneicewolf/Stuxnet-Source/raw/refs/heads/ONLY_MALWARE/00000000AltDuqDrop.dll.7z
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffaeaf6c188,0x7ffaeaf6c194,0x7ffaeaf6c1a0
      2⤵
        PID:656
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,6488739509865027611,13300682830209827130,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        2⤵
        • System Time Discovery
        PID:4616
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,3295606509869822791,13015471259360213267,262144 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
        2⤵
          PID:1032
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,7725747379516426222,6047597662371352925,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
          2⤵
            PID:396
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,16807138809436714227,910278508636976447,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
            2⤵
              PID:1468
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,8017613792445664119,14426755056174662618,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
              2⤵
                PID:4632
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7637919139699598362,16749442247268688445,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                2⤵
                  PID:2176
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,7933923761273474384,14484877299237750926,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
                  2⤵
                    PID:724
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,15842945060005997124,10073998683117586904,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
                    2⤵
                      PID:572
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4332,i,1494612738589579606,6538103637537463789,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:9
                      2⤵
                        PID:4016
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,6610665151723639214,4692586521729210945,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
                        2⤵
                          PID:1496
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,2674866692137497067,16964619924516750555,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
                          2⤵
                            PID:4764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10878601928891973750,11127103668053828261,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
                            2⤵
                              PID:712
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10883861404678016543,3043749325877863126,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
                              2⤵
                                PID:2656
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5600,i,6218628481499248683,14708052051953355156,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
                                2⤵
                                  PID:2056
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12081932362007084720,3209989307310127358,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
                                  2⤵
                                    PID:4176
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10421059473347110108,13049259306674951500,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
                                    2⤵
                                    • NTFS ADS
                                    PID:4040
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,14108674597035199257,16914250718436465928,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3372
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1128
                                      3⤵
                                        PID:4700
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,9800540323520741575,2515434754467764169,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
                                      2⤵
                                        PID:3172
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,9800540323520741575,2515434754467764169,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
                                        2⤵
                                          PID:4664
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,7179372012674451644,13085138479746415416,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
                                          2⤵
                                            PID:3820
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,729662182540244542,8713993339956621709,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
                                            2⤵
                                              PID:3460
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,2716019135925573951,14199863087763928392,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
                                              2⤵
                                                PID:4124
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,5141821084362337702,7488562075992831296,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
                                                2⤵
                                                  PID:4516
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,13380076825869436137,5250419420104320091,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
                                                  2⤵
                                                    PID:4732
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,511263749162353058,7550734155908888134,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
                                                    2⤵
                                                      PID:596
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11043847415034502163,15139971475508815344,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
                                                      2⤵
                                                        PID:4168
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,13383567469037329365,10902581123298751097,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
                                                        2⤵
                                                          PID:5048
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1409936657229192116,8892923734096423802,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
                                                          2⤵
                                                            PID:780
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6340,i,3511583151264449864,13674976928877503215,2097152 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
                                                            2⤵
                                                              PID:3992
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17907742673619153931,18316178235729613758,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                                              2⤵
                                                                PID:5116
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11766197698200372000,8426177030936353392,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
                                                                2⤵
                                                                  PID:1640
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,7352292976392073666,17005816058082533047,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
                                                                  2⤵
                                                                    PID:4320
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5128,i,10490326786372653448,6499074495856196000,262144 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:10
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:2188
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,11524757417481073875,630788125095636738,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
                                                                    2⤵
                                                                      PID:712
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,16944073427480636921,6438660933194391369,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:14
                                                                      2⤵
                                                                        PID:3544
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,16252605528254577021,14851268316725845941,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14
                                                                        2⤵
                                                                          PID:4600
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,8402641116237770572,2534929920049326141,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
                                                                          2⤵
                                                                            PID:3852
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,17917353997467143165,10009318387254177579,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
                                                                            2⤵
                                                                              PID:2544
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,11946403770745686212,6132341230102965097,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
                                                                              2⤵
                                                                                PID:4124
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,5795977866124316233,3862990515690939951,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
                                                                                2⤵
                                                                                  PID:2576
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,12618108449866198048,9778829921141056442,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
                                                                                  2⤵
                                                                                    PID:4716
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,2659036877223441296,1726600117656103081,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
                                                                                    2⤵
                                                                                      PID:3700
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,1965868932282928636,5974971658341706075,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
                                                                                      2⤵
                                                                                        PID:5360
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,1771091723871579888,4746198206264492923,524288 --field-trial-handle=2008,i,14807521307500046173,5899187686199472442,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
                                                                                        2⤵
                                                                                          PID:5972
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                        1⤵
                                                                                          PID:5116
                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                          1⤵
                                                                                            PID:4296
                                                                                          • C:\Program Files\7-Zip\7zG.exe
                                                                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\" -spe -an -ai#7zMap16941:104:7zEvent30725
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:4040
                                                                                          • C:\Program Files\7-Zip\7zG.exe
                                                                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\" -spe -an -ai#7zMap9224:104:7zEvent10764
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:3352
                                                                                          • C:\Program Files\7-Zip\7zG.exe
                                                                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\" -spe -an -ai#7zMap29451:104:7zEvent9862
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:3228
                                                                                          • C:\Program Files\7-Zip\7zG.exe
                                                                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\" -spe -an -ai#7zMap9887:104:7zEvent3303
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:4476
                                                                                          • C:\Program Files\7-Zip\7zG.exe
                                                                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\" -spe -an -ai#7zMap25093:104:7zEvent23286
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:4640
                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                            1⤵
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:964
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\00000000.dll"
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Checks processor information in registry
                                                                                              • Modifies Internet Explorer settings
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4872
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4612
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EB02C45627F75315EFA2C7E33FEC0F94 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EB02C45627F75315EFA2C7E33FEC0F94 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2816
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3FF309727A7B5C3C441AB5F9AE647BC6 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4604
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=32BC169618BA127F968BA93F4E57855B --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3320
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=77FAA990853D3FCC9FC53FA16CF73592 --mojo-platform-channel-handle=2012 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2280
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9AEBDEA719A6D8F7740DA67084283BB4 --mojo-platform-channel-handle=2008 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:196
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:5040
                                                                                            • C:\Windows\system32\sihost.exe
                                                                                              sihost.exe
                                                                                              1⤵
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              PID:3816
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                                                2⤵
                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                • Enumerates connected drives
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:472
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4284
                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                              1⤵
                                                                                              • Enumerates system info in registry
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:3620
                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:5748
                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                              1⤵
                                                                                                PID:2232
                                                                                              • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
                                                                                                "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\."
                                                                                                1⤵
                                                                                                  PID:2528
                                                                                                  • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
                                                                                                    wt.exe -d "C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\."
                                                                                                    2⤵
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5420
                                                                                                    • C:\Windows\system32\wsl.exe
                                                                                                      C:\Windows\system32\wsl.exe --list
                                                                                                      3⤵
                                                                                                        PID:5492
                                                                                                      • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
                                                                                                        "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0x9e8 --server 0x9e4
                                                                                                        3⤵
                                                                                                          PID:5848
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell.exe
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:5868

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          blocklist
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                          • Size 105KB
                                                                                                          • SHA256 ea7d35662c775981bfd2f94129eb6c8317e6a5aac89390af163f621e08976632
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          protocols.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                          • Size 3KB
                                                                                                          • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          crl-set
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                          • Size 22KB
                                                                                                          • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          settings.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                          • Size 280B
                                                                                                          • SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          settings.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                          • Size 280B
                                                                                                          • SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          LOG.old
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                          • Size 352B
                                                                                                          • SHA256 70128d776ab2982d7a6abf02890ce7805b7490472e1c1e835b4c7ad72e441bf4
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                          • Size 6B
                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          the-real-index
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                          • Size 3KB
                                                                                                          • SHA256 8e4075e1bbaf193c323db6df9ec4b55d290ec7be548f7986606c2a431b6b4bab
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          the-real-index~RFe583e6b.TMP
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583e6b.TMP
                                                                                                          • Size 3KB
                                                                                                          • SHA256 d7079eb44e213891d485b1d3145d9c003c0b398636a2992047d799c646f2eca0
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          SiteList-Enterprise.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                          • Size 2B
                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Edge Profile.ico
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                          • Size 70KB
                                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          HubApps
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                          • Size 105KB
                                                                                                          • SHA256 a3e0ed3b7b22eb63f8d684039026c6d1cf309dea226c1060864a6dde8ef4297c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Network Persistent State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                          • Size 2KB
                                                                                                          • SHA256 7cfff39a425c0be0cbe08f37a3322387c09d79eebf394eb0eba8d8f27326d690
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          Network Persistent State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                          • Size 111B
                                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          Network Persistent State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                          • Size 2KB
                                                                                                          • SHA256 bf2c50aaef248da12b24bda1d2f2d903da99fe7de4a87719c442000b5145a276
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          SCT Auditing Pending Reports
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                          • Size 2B
                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                          • Size 13KB
                                                                                                          • SHA256 6bf611c77a30d20af8ef9fc349f55fae7e795367ac0fa63b7f68f18a20c9a735
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                          • Size 14KB
                                                                                                          • SHA256 dbfa7128ffc4f4dc6d6c4cfd545e5ba38d978cf87027ad3f4586ee7383a46437
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                          • Size 14KB
                                                                                                          • SHA256 795734e1a6943c7d0e7195b9034885d860e06ed6807c476d3ba5fcc76fa6dfa8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Secure Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                          • Size 36KB
                                                                                                          • SHA256 af5727678aa324f8248a219d4eb37971aa095de46d5ede12fe23a70df8b27304
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          the-real-index
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9bcacea6-6543-4fa8-92d6-91e6836de9a1\index-dir\the-real-index
                                                                                                          • Size 1KB
                                                                                                          • SHA256 f4e85cf2904cdfa6c9111c9463108feff0b6c50cce040cf552a749c76ca34eae
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          the-real-index~RFe5c8de0.TMP
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9bcacea6-6543-4fa8-92d6-91e6836de9a1\index-dir\the-real-index~RFe5c8de0.TMP
                                                                                                          • Size 1KB
                                                                                                          • SHA256 9bd544e1000e9f3b49ea495a4bd0000234a2a7eed2e352f2a348209ae5c34e5b
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          index.txt
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                          • Size 371B
                                                                                                          • SHA256 d3d095409d5227d2d081dddb8ec25ce4ea4555b10b9315576cd57b0115a37e3b
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          sync_diagnostic.log
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                          • Size 6KB
                                                                                                          • SHA256 0880184d8215f064938a9060f73987b55833321e24c7d3dbe37c4eb37f54a825
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          CURRENT
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                          • Size 16B
                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          MANIFEST-000001
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                          • Size 41B
                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          4a31fe6e-a60b-4201-a59c-f6bfec119d01.tmp
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4a31fe6e-a60b-4201-a59c-f6bfec119d01.tmp
                                                                                                          • Size 22KB
                                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          office_endpoints_list.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                                          • Size 3KB
                                                                                                          • SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 23KB
                                                                                                          • SHA256 060f34a6445b40dc53e8958a4ea2d3366ced51d875946569f0cd3907ef3f82d4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 18KB
                                                                                                          • SHA256 82bba3a909b049afc296252b7ea06cd086bee0533b7ab4854c2446dd96132558
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 18KB
                                                                                                          • SHA256 0868869e8ca5db1a0079ad93101b28af7a8e390e9d19aaa7fe4cbdbb1ef00ae5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 18KB
                                                                                                          • SHA256 87462def36ccf8ddc3c40fb9ce5bb4623c4d4618f3b84af146171bddb215194e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 24KB
                                                                                                          • SHA256 40924a5226243a48b3ec126c2110efa7d7c2aa33381198d28f5f4aaafc55c65c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 24KB
                                                                                                          • SHA256 c3659f091bc87e236cdc3772b78418d660a20813faa252f61611dcc34cee9053
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 8KB
                                                                                                          • SHA256 183e1a55440da63ccf8348a71d81fd8384fd157cae3fcd7208ee38162e3e083a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 8KB
                                                                                                          • SHA256 ee3b0cd4b24f1a284e1372d44f6b25b1af30242396c1777078ff91ddebf28914
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 24KB
                                                                                                          • SHA256 15f1973a72fe3e57e9263a8d97845e0a3f8cfaf807c57512fd03096a6f6c1cf3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          keys.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.9.29.1\keys.json
                                                                                                          • Size 8KB
                                                                                                          • SHA256 e5b57a8978e405e9487c43e6b0b3685c4c71cdaa2e74e25d7fbed75ffaea01b2
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          nav_config.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                          • Size 2KB
                                                                                                          • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 132B
                                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 1KB
                                                                                                          • SHA256 db07bb07af155ffc0493577fbb516745dd85d5fd63864e780c530700fa75a5cb
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 492B
                                                                                                          • SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 1KB
                                                                                                          • SHA256 1eba785e2deb2241b32db803eed284371ae89d469ed051b977113e1e1c310471
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 372B
                                                                                                          • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 972B
                                                                                                          • SHA256 b803572df39945f6cb94491f8714edefb81281b7ef5682b67be261291f413979
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 612B
                                                                                                          • SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 732B
                                                                                                          • SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 852B
                                                                                                          • SHA256 73b51f2395ebe9c767c17b69ca86dacf526576dd832b29bf081ec5aaf54582ce
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          metadata.json
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                          • Size 252B
                                                                                                          • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          af9c8b00-e36b-4577-b82f-f5dadcd3ad4c.tmp
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af9c8b00-e36b-4577-b82f-f5dadcd3ad4c.tmp
                                                                                                          • Size 13B
                                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          iconcache_idx.db
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                          • Size 28KB
                                                                                                          • SHA256 815af88196732791e5d247ecaf17b0f48cdd673ffec85eb027d1acfd6879a4e2
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          www.bing[1].xml
                                                                                                          • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\D01MB0NM\www.bing[1].xml
                                                                                                          • Size 4KB
                                                                                                          • SHA256 70f672e461a608c98d008772ebc2a2ab8f327fcefeb84cc335f90fda705fc500
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SearchHoverUnifiedTileModelCache.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                          • Size 22KB
                                                                                                          • SHA256 9996ae9e60a00489fd1ce2cf8a78cc2084e79631777c76ef84e40250141a1a44
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          26c462ef-5de0-40ea-8ea0-83fbd00216a2.tmp
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\26c462ef-5de0-40ea-8ea0-83fbd00216a2.tmp
                                                                                                          • Size 146KB
                                                                                                          • SHA256 31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          387c76d3-b508-46e1-b98c-f55553c617a5.tmp
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\387c76d3-b508-46e1-b98c-f55553c617a5.tmp
                                                                                                          • Size 1B
                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          9de78bef-1e63-4e65-ba71-3745af023086.tmp
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\9de78bef-1e63-4e65-ba71-3745af023086.tmp
                                                                                                          • Size 10KB
                                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          __PSScriptPolicyTest_tioffkdc.mly.ps1
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tioffkdc.mly.ps1
                                                                                                          • Size 60B
                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          content_new.js
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3044_1039380364\CRX_INSTALL\content_new.js
                                                                                                          • Size 10KB
                                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          00000000AltDuqDrop.dll.7z
                                                                                                          • Path C:\Users\Admin\Downloads\00000000AltDuqDrop.dll.7z
                                                                                                          • Size 9KB
                                                                                                          • SHA256 b22afaf415911e453ad8c84db59746682376ba16c2d71cee19e8e0cc72cbf7e5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          00000000AltDuqDrop.dll.7z:Zone.Identifier
                                                                                                          • Path C:\Users\Admin\Downloads\00000000AltDuqDrop.dll.7z:Zone.Identifier
                                                                                                          • Size 146B
                                                                                                          • SHA256 4a6cbc97f3d1d298fa0e713e5952c6b6dc0cbf99447f04705a400773d8efeda3
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          00000000.dll
                                                                                                          • Path C:\Users\Admin\Downloads\00000000AltDuqDrop.dll\00000000.dll
                                                                                                          • Size 18KB
                                                                                                          • SHA256 fc0cc93beee1bb8ecc71a53ceb164875f00a2d21e97e81993371fc9c047dbc5f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          LICENSE
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1027265600\LICENSE
                                                                                                          • Size 1KB
                                                                                                          • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1027265600\manifest.json
                                                                                                          • Size 79B
                                                                                                          • SHA256 7c00a941d7a04048f469ffb986ff7e8bf349f149639cc474a463da4a607c0a70
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1068213134\manifest.json
                                                                                                          • Size 135B
                                                                                                          • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1170070240\manifest.json
                                                                                                          • Size 238B
                                                                                                          • SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1541268132\manifest.json
                                                                                                          • Size 160B
                                                                                                          • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1671255728\manifest.json
                                                                                                          • Size 43B
                                                                                                          • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1733495150\manifest.json
                                                                                                          • Size 135B
                                                                                                          • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_2012381350\manifest.json
                                                                                                          • Size 113B
                                                                                                          • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_286951471\manifest.json
                                                                                                          • Size 177B
                                                                                                          • SHA256 22238dd45642a2b87097036e510f29517f0e1587435f1d66761468da73e4c9bf
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_774025457\manifest.json
                                                                                                          • Size 85B
                                                                                                          • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          manifest.json
                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_903113110\manifest.json
                                                                                                          • Size 160B
                                                                                                          • SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          memory/196-889-0x0000000002080000-0x000000000217E000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2280-886-0x0000000001E40000-0x0000000001F3E000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2816-896-0x0000000001D70000-0x0000000001E6E000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3320-883-0x0000000001C30000-0x0000000001D2E000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3352-615-0x0000021DE79A0000-0x0000021DE7B4C000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3352-646-0x0000021DE79A0000-0x0000021DE7B4C000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1030-0x0000022173370000-0x0000022173390000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1699-0x0000022173160000-0x0000022173180000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1289-0x0000022176DF0000-0x0000022176EF0000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-981-0x000002205F460000-0x000002205F560000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1055-0x00000220716C0000-0x00000220717C0000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1007-0x0000022173160000-0x0000022173180000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1722-0x0000022174500000-0x0000022174520000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3620-1008-0x0000022071A60000-0x0000022071A80000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4040-524-0x00000157224F0000-0x000001572269C000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4040-546-0x00000157224F0000-0x000001572269C000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4476-829-0x0000029C62C40000-0x0000029C62DEC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4476-701-0x0000029C62C40000-0x0000029C62DEC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4476-719-0x0000029C62C40000-0x0000029C62DEC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4604-880-0x0000000001CD0000-0x0000000001DCE000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4612-900-0x0000000002350000-0x000000000244E000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4640-833-0x00000200FA940000-0x00000200FAAEC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4872-901-0x0000000006600000-0x00000000066FE000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5116-47-0x00000210410D0000-0x000002104127C000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5868-1834-0x0000012ADE820000-0x0000012ADE842000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5868-1836-0x0000012ADECA0000-0x0000012ADECE6000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5868-1839-0x0000012ADE7F0000-0x0000012ADE802000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5868-1838-0x0000012AC46C0000-0x0000012AC486C000-memory.dmp
                                                                                                          Download