Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 22:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_2dc49920b84fe85b8e6fa4e1a8308535_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-2krqvstelc
  • SHA256 a60f27607d461dee2bf5a761c32a4703f2581d6b5c3a07fb525c567fb2b77626
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2dc49920b84fe85b8e6fa4e1a8308535_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2dc49920b84fe85b8e6fa4e1a8308535_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:5936
    • C:\Users\Admin\AppData\Local\Temp\jwbayr.exe
      "C:\Users\Admin\AppData\Local\Temp\jwbayr.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4128
      • C:\Users\Admin\AppData\Local\Temp\jwbayr.exe
        "C:\Users\Admin\AppData\Local\Temp\jwbayr.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Users\Admin\AppData\Roaming\Download\900896.exe
          "C:\Users\Admin\AppData\Roaming\Download\900896.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:704
          • C:\Users\Admin\AppData\Roaming\Download\900896.exe
            "C:\Users\Admin\AppData\Roaming\Download\900896.exe"
            5⤵
            • Executes dropped EXE
            PID:5688
        • C:\Users\Admin\AppData\Roaming\Download\609655.exe
          "C:\Users\Admin\AppData\Roaming\Download\609655.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5224
          • C:\Users\Admin\AppData\Roaming\Download\609655.exe
            "C:\Users\Admin\AppData\Roaming\Download\609655.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6036
        • C:\Users\Admin\AppData\Roaming\Download\694273.exe
          "C:\Users\Admin\AppData\Roaming\Download\694273.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5532
          • C:\Users\Admin\AppData\Roaming\Download\694273.exe
            "C:\Users\Admin\AppData\Roaming\Download\694273.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5872
        • C:\Users\Admin\AppData\Roaming\Download\391942.exe
          "C:\Users\Admin\AppData\Roaming\Download\391942.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\Users\Admin\AppData\Roaming\Download\391942.exe
            "C:\Users\Admin\AppData\Roaming\Download\391942.exe"
            5⤵
            • Executes dropped EXE
            PID:1676
        • C:\Users\Admin\AppData\Roaming\Download\201294.exe
          "C:\Users\Admin\AppData\Roaming\Download\201294.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Users\Admin\AppData\Roaming\Download\201294.exe
            "C:\Users\Admin\AppData\Roaming\Download\201294.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4360
        • C:\Users\Admin\AppData\Roaming\Download\560193.exe
          "C:\Users\Admin\AppData\Roaming\Download\560193.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3384
          • C:\Users\Admin\AppData\Roaming\Download\560193.exe
            "C:\Users\Admin\AppData\Roaming\Download\560193.exe"
            5⤵
            • Executes dropped EXE
            PID:1176
        • C:\Users\Admin\AppData\Roaming\Download\062602.exe
          "C:\Users\Admin\AppData\Roaming\Download\062602.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4316
          • C:\Users\Admin\AppData\Roaming\Download\062602.exe
            "C:\Users\Admin\AppData\Roaming\Download\062602.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5208
        • C:\Users\Admin\AppData\Roaming\Download\173394.exe
          "C:\Users\Admin\AppData\Roaming\Download\173394.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5596
          • C:\Users\Admin\AppData\Roaming\Download\173394.exe
            "C:\Users\Admin\AppData\Roaming\Download\173394.exe"
            5⤵
            • Executes dropped EXE
            PID:3580
        • C:\Users\Admin\AppData\Roaming\Download\677925.exe
          "C:\Users\Admin\AppData\Roaming\Download\677925.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Users\Admin\AppData\Roaming\Download\677925.exe
            "C:\Users\Admin\AppData\Roaming\Download\677925.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5176
        • C:\Users\Admin\AppData\Roaming\Download\752073.exe
          "C:\Users\Admin\AppData\Roaming\Download\752073.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3620
          • C:\Users\Admin\AppData\Roaming\Download\752073.exe
            "C:\Users\Admin\AppData\Roaming\Download\752073.exe"
            5⤵
            • Executes dropped EXE
            PID:4192
        • C:\Users\Admin\AppData\Roaming\Download\221321.exe
          "C:\Users\Admin\AppData\Roaming\Download\221321.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5384
          • C:\Users\Admin\AppData\Roaming\Download\221321.exe
            "C:\Users\Admin\AppData\Roaming\Download\221321.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2444
        • C:\Users\Admin\AppData\Roaming\Download\470290.exe
          "C:\Users\Admin\AppData\Roaming\Download\470290.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1224
          • C:\Users\Admin\AppData\Roaming\Download\470290.exe
            "C:\Users\Admin\AppData\Roaming\Download\470290.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3948
        • C:\Users\Admin\AppData\Roaming\Download\861914.exe
          "C:\Users\Admin\AppData\Roaming\Download\861914.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2616
          • C:\Users\Admin\AppData\Roaming\Download\861914.exe
            "C:\Users\Admin\AppData\Roaming\Download\861914.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1804
        • C:\Users\Admin\AppData\Roaming\Download\055270.exe
          "C:\Users\Admin\AppData\Roaming\Download\055270.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2668
          • C:\Users\Admin\AppData\Roaming\Download\055270.exe
            "C:\Users\Admin\AppData\Roaming\Download\055270.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4568
        • C:\Users\Admin\AppData\Roaming\Download\455994.exe
          "C:\Users\Admin\AppData\Roaming\Download\455994.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2444
          • C:\Users\Admin\AppData\Roaming\Download\455994.exe
            "C:\Users\Admin\AppData\Roaming\Download\455994.exe"
            5⤵
            • Executes dropped EXE
            PID:3396
        • C:\Users\Admin\AppData\Roaming\Download\957405.exe
          "C:\Users\Admin\AppData\Roaming\Download\957405.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2216
          • C:\Users\Admin\AppData\Roaming\Download\957405.exe
            "C:\Users\Admin\AppData\Roaming\Download\957405.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3948
        • C:\Users\Admin\AppData\Roaming\Download\783849.exe
          "C:\Users\Admin\AppData\Roaming\Download\783849.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1200
          • C:\Users\Admin\AppData\Roaming\Download\783849.exe
            "C:\Users\Admin\AppData\Roaming\Download\783849.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2160
        • C:\Users\Admin\AppData\Roaming\Download\042648.exe
          "C:\Users\Admin\AppData\Roaming\Download\042648.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4060
          • C:\Users\Admin\AppData\Roaming\Download\042648.exe
            "C:\Users\Admin\AppData\Roaming\Download\042648.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4564
        • C:\Users\Admin\AppData\Roaming\Download\332352.exe
          "C:\Users\Admin\AppData\Roaming\Download\332352.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3580
          • C:\Users\Admin\AppData\Roaming\Download\332352.exe
            "C:\Users\Admin\AppData\Roaming\Download\332352.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4688
        • C:\Users\Admin\AppData\Roaming\Download\446428.exe
          "C:\Users\Admin\AppData\Roaming\Download\446428.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1820
          • C:\Users\Admin\AppData\Roaming\Download\446428.exe
            "C:\Users\Admin\AppData\Roaming\Download\446428.exe"
            5⤵
            • Executes dropped EXE
            PID:5816
        • C:\Users\Admin\AppData\Roaming\Download\280864.exe
          "C:\Users\Admin\AppData\Roaming\Download\280864.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:416
          • C:\Users\Admin\AppData\Roaming\Download\280864.exe
            "C:\Users\Admin\AppData\Roaming\Download\280864.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2340
        • C:\Users\Admin\AppData\Roaming\Download\680568.exe
          "C:\Users\Admin\AppData\Roaming\Download\680568.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3864
          • C:\Users\Admin\AppData\Roaming\Download\680568.exe
            "C:\Users\Admin\AppData\Roaming\Download\680568.exe"
            5⤵
            • Executes dropped EXE
            PID:3876
        • C:\Users\Admin\AppData\Roaming\Download\706441.exe
          "C:\Users\Admin\AppData\Roaming\Download\706441.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5836
          • C:\Users\Admin\AppData\Roaming\Download\706441.exe
            "C:\Users\Admin\AppData\Roaming\Download\706441.exe"
            5⤵
            • Executes dropped EXE
            PID:2740
        • C:\Users\Admin\AppData\Roaming\Download\910806.exe
          "C:\Users\Admin\AppData\Roaming\Download\910806.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5952
          • C:\Users\Admin\AppData\Roaming\Download\910806.exe
            "C:\Users\Admin\AppData\Roaming\Download\910806.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5228
        • C:\Users\Admin\AppData\Roaming\Download\556152.exe
          "C:\Users\Admin\AppData\Roaming\Download\556152.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4388
          • C:\Users\Admin\AppData\Roaming\Download\556152.exe
            "C:\Users\Admin\AppData\Roaming\Download\556152.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:560
        • C:\Users\Admin\AppData\Roaming\Download\956866.exe
          "C:\Users\Admin\AppData\Roaming\Download\956866.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5132
          • C:\Users\Admin\AppData\Roaming\Download\956866.exe
            "C:\Users\Admin\AppData\Roaming\Download\956866.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3876
        • C:\Users\Admin\AppData\Roaming\Download\516560.exe
          "C:\Users\Admin\AppData\Roaming\Download\516560.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5400
          • C:\Users\Admin\AppData\Roaming\Download\516560.exe
            "C:\Users\Admin\AppData\Roaming\Download\516560.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4712
        • C:\Users\Admin\AppData\Roaming\Download\907274.exe
          "C:\Users\Admin\AppData\Roaming\Download\907274.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1804
          • C:\Users\Admin\AppData\Roaming\Download\907274.exe
            "C:\Users\Admin\AppData\Roaming\Download\907274.exe"
            5⤵
            • Executes dropped EXE
            PID:1560
        • C:\Users\Admin\AppData\Roaming\Download\654395.exe
          "C:\Users\Admin\AppData\Roaming\Download\654395.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4564
          • C:\Users\Admin\AppData\Roaming\Download\654395.exe
            "C:\Users\Admin\AppData\Roaming\Download\654395.exe"
            5⤵
            • Executes dropped EXE
            PID:5332
        • C:\Users\Admin\AppData\Roaming\Download\155019.exe
          "C:\Users\Admin\AppData\Roaming\Download\155019.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2832
          • C:\Users\Admin\AppData\Roaming\Download\155019.exe
            "C:\Users\Admin\AppData\Roaming\Download\155019.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4572
        • C:\Users\Admin\AppData\Roaming\Download\404188.exe
          "C:\Users\Admin\AppData\Roaming\Download\404188.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1736
          • C:\Users\Admin\AppData\Roaming\Download\404188.exe
            "C:\Users\Admin\AppData\Roaming\Download\404188.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:6044
        • C:\Users\Admin\AppData\Roaming\Download\650061.exe
          "C:\Users\Admin\AppData\Roaming\Download\650061.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1168
          • C:\Users\Admin\AppData\Roaming\Download\650061.exe
            "C:\Users\Admin\AppData\Roaming\Download\650061.exe"
            5⤵
              PID:4304
          • C:\Users\Admin\AppData\Roaming\Download\057584.exe
            "C:\Users\Admin\AppData\Roaming\Download\057584.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1264
            • C:\Users\Admin\AppData\Roaming\Download\057584.exe
              "C:\Users\Admin\AppData\Roaming\Download\057584.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1228
          • C:\Users\Admin\AppData\Roaming\Download\685722.exe
            "C:\Users\Admin\AppData\Roaming\Download\685722.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2620
            • C:\Users\Admin\AppData\Roaming\Download\685722.exe
              "C:\Users\Admin\AppData\Roaming\Download\685722.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5876
          • C:\Users\Admin\AppData\Roaming\Download\973444.exe
            "C:\Users\Admin\AppData\Roaming\Download\973444.exe" /Shorttailedrestart
            4⤵
              PID:1976
              • C:\Users\Admin\AppData\Roaming\Download\973444.exe
                "C:\Users\Admin\AppData\Roaming\Download\973444.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2336
            • C:\Users\Admin\AppData\Roaming\Download\544358.exe
              "C:\Users\Admin\AppData\Roaming\Download\544358.exe" /Shorttailedrestart
              4⤵
                PID:5708
                • C:\Users\Admin\AppData\Roaming\Download\544358.exe
                  "C:\Users\Admin\AppData\Roaming\Download\544358.exe"
                  5⤵
                    PID:4288
                • C:\Users\Admin\AppData\Roaming\Download\803137.exe
                  "C:\Users\Admin\AppData\Roaming\Download\803137.exe" /Shorttailedrestart
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:832
                  • C:\Users\Admin\AppData\Roaming\Download\803137.exe
                    "C:\Users\Admin\AppData\Roaming\Download\803137.exe"
                    5⤵
                      PID:1172
                  • C:\Users\Admin\AppData\Roaming\Download\193849.exe
                    "C:\Users\Admin\AppData\Roaming\Download\193849.exe" /Shorttailedrestart
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3452
                    • C:\Users\Admin\AppData\Roaming\Download\193849.exe
                      "C:\Users\Admin\AppData\Roaming\Download\193849.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1220
                  • C:\Users\Admin\AppData\Roaming\Download\349722.exe
                    "C:\Users\Admin\AppData\Roaming\Download\349722.exe" /Shorttailedrestart
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2592
                    • C:\Users\Admin\AppData\Roaming\Download\349722.exe
                      "C:\Users\Admin\AppData\Roaming\Download\349722.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:2656
                  • C:\Users\Admin\AppData\Roaming\Download\716510.exe
                    "C:\Users\Admin\AppData\Roaming\Download\716510.exe" /Shorttailedrestart
                    4⤵
                      PID:6104
                      • C:\Users\Admin\AppData\Roaming\Download\716510.exe
                        "C:\Users\Admin\AppData\Roaming\Download\716510.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5056
                    • C:\Users\Admin\AppData\Roaming\Download\820987.exe
                      "C:\Users\Admin\AppData\Roaming\Download\820987.exe" /Shorttailedrestart
                      4⤵
                        PID:3092
                        • C:\Users\Admin\AppData\Roaming\Download\820987.exe
                          "C:\Users\Admin\AppData\Roaming\Download\820987.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:1304
                      • C:\Users\Admin\AppData\Roaming\Download\211691.exe
                        "C:\Users\Admin\AppData\Roaming\Download\211691.exe" /Shorttailedrestart
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2796
                        • C:\Users\Admin\AppData\Roaming\Download\211691.exe
                          "C:\Users\Admin\AppData\Roaming\Download\211691.exe"
                          5⤵
                            PID:5064
                        • C:\Users\Admin\AppData\Roaming\Download\606399.exe
                          "C:\Users\Admin\AppData\Roaming\Download\606399.exe" /Shorttailedrestart
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5844
                          • C:\Users\Admin\AppData\Roaming\Download\606399.exe
                            "C:\Users\Admin\AppData\Roaming\Download\606399.exe"
                            5⤵
                              PID:2944
                          • C:\Users\Admin\AppData\Roaming\Download\693766.exe
                            "C:\Users\Admin\AppData\Roaming\Download\693766.exe" /Shorttailedrestart
                            4⤵
                              PID:4736
                              • C:\Users\Admin\AppData\Roaming\Download\693766.exe
                                "C:\Users\Admin\AppData\Roaming\Download\693766.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:424
                            • C:\Users\Admin\AppData\Roaming\Download\980554.exe
                              "C:\Users\Admin\AppData\Roaming\Download\980554.exe" /Shorttailedrestart
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:5228
                              • C:\Users\Admin\AppData\Roaming\Download\980554.exe
                                "C:\Users\Admin\AppData\Roaming\Download\980554.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:1068
                            • C:\Users\Admin\AppData\Roaming\Download\061703.exe
                              "C:\Users\Admin\AppData\Roaming\Download\061703.exe" /Shorttailedrestart
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:4268
                              • C:\Users\Admin\AppData\Roaming\Download\061703.exe
                                "C:\Users\Admin\AppData\Roaming\Download\061703.exe"
                                5⤵
                                  PID:2972
                              • C:\Users\Admin\AppData\Roaming\Download\451617.exe
                                "C:\Users\Admin\AppData\Roaming\Download\451617.exe" /Shorttailedrestart
                                4⤵
                                  PID:1352
                                  • C:\Users\Admin\AppData\Roaming\Download\451617.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\451617.exe"
                                    5⤵
                                      PID:1604
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                2⤵
                                • Drops file in Windows directory
                                • Enumerates system info in registry
                                • Modifies registry class
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of WriteProcessMemory
                                PID:5640
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ff83eefc188,0x7ff83eefc194,0x7ff83eefc1a0
                                  3⤵
                                    PID:4156
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,693329322790911405,14452614391016439231,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
                                    3⤵
                                    • System Time Discovery
                                    PID:748
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,16006289555864750466,5299934136361560463,262144 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
                                    3⤵
                                      PID:5940
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,5774494954393327004,17220405065021405500,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
                                      3⤵
                                        PID:5092
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,195384863509139057,11685817067744005248,2097152 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                                        3⤵
                                          PID:3748
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,3174358253281611443,17173210751264437872,2097152 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                                          3⤵
                                            PID:4644
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,18167343622732204283,8251243648728772459,2097152 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
                                            3⤵
                                              PID:1824
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11645204446372318239,12571718168906392994,2097152 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
                                              3⤵
                                                PID:1648
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11658120202453929243,3066727053338472337,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
                                                3⤵
                                                  PID:3168
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5464,i,14500343982655914911,11069510805769749306,2097152 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
                                                  3⤵
                                                    PID:5688
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,4362406767847213587,16020909576085008770,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                                                    3⤵
                                                      PID:4448
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,14571346293255170706,4685662209088456581,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
                                                      3⤵
                                                        PID:3452
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2018644987200966739,15733669529607936391,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
                                                        3⤵
                                                          PID:5512
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2018644987200966739,15733669529607936391,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
                                                          3⤵
                                                            PID:4084
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,11659859594227504350,2611454629019404211,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
                                                            3⤵
                                                            • Modifies registry class
                                                            PID:1684
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,8628029086194003670,16668113231911993557,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:12
                                                            3⤵
                                                              PID:3404
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,10868586551749207517,5193797882035499065,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
                                                              3⤵
                                                                PID:5664
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,3358010340819721209,9922520938122785842,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
                                                                3⤵
                                                                  PID:1544
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,14291724176948534594,13631130959752527987,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
                                                                  3⤵
                                                                    PID:1784
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,7447976950154510852,11714763210458734465,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                                                    3⤵
                                                                      PID:1520
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,17937592927686013641,14611622636441200445,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
                                                                      3⤵
                                                                        PID:4260
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,7118124855681441385,2471125896155960098,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
                                                                        3⤵
                                                                          PID:5852
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,5310974656917378897,12597281991789463427,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
                                                                          3⤵
                                                                            PID:5816
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,15522274076313753259,8332864658925354996,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:14
                                                                            3⤵
                                                                              PID:3880
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,8975916337480991456,5983305847220271618,262144 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:10
                                                                              3⤵
                                                                                PID:4676
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,15500525063082982574,11412524144435097629,524288 --field-trial-handle=2544,i,10709281936516720260,17834713605704249163,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
                                                                                3⤵
                                                                                  PID:4700
                                                                              • C:\Windows\explorer.exe
                                                                                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                2⤵
                                                                                  PID:6084
                                                                              • C:\Windows\explorer.exe
                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4672
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                  2⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:2740
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:1704
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                  1⤵
                                                                                    PID:2884

                                                                                  Network

                                                                                        MITRE ATT&CK Enterprise v16

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        DouTuDaShi.exe
                                                                                        • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                        • Size 1.1MB
                                                                                        • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 280B
                                                                                        • SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 280B
                                                                                        • SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        temp-index
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                        • Size 4KB
                                                                                        • SHA256 9ff78c1680b090d71be5e88f3fadad8a84d2dfb2b28737eefbe00e48cd7c6578
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        the-real-index
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                        • Size 4KB
                                                                                        • SHA256 0c3fe5370407e09a95b5e04e72f5fbc8d31c74639ba1f9a0c05263127c6d03fb
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        the-real-index~RFe59c4bd.TMP
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c4bd.TMP
                                                                                        • Size 3KB
                                                                                        • SHA256 e4213e77ebe2609e6a9b9c9ae935480642cbb627d360274f74a2b26281e54666
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        SiteList-Enterprise.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                        • Size 2B
                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Edge Profile.ico
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                        • Size 70KB
                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Network Persistent State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                        • Size 1KB
                                                                                        • SHA256 cba52682a3a433070b1909ff6802cb337f50da0dbcec57d8e130cab5d46d23d6
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        Network Persistent State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                        • Size 5KB
                                                                                        • SHA256 5c7d5ad75aafd4d1efca1210435a9dc28021eec13c60628338ba6683e56ee31d
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        SCT Auditing Pending Reports
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                        • Size 2B
                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Sdch Dictionaries
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                        • Size 40B
                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 12KB
                                                                                        • SHA256 f8b38c0e2f8d318f233aef29840b6b2c373c302edc5992f06a7a46cab0dc836e
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 12KB
                                                                                        • SHA256 9b52818ce9414e1a3f5e803900961079891ef8de7f00d18c23e57c18e1cc3a10
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 12KB
                                                                                        • SHA256 e6f570477d0aa818ee03e2bf2dfc7569c2fcb3c3344b72d13d8bd310a53fd9bf
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Secure Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                        • Size 27KB
                                                                                        • SHA256 ce3fded615a34837e6462cab4988e63ead9ef503fc61b82ec0ec0f91f1219381
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        OperationConfig
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                        • Size 22KB
                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        OperationConfig~RFe5a42b7.TMP
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a42b7.TMP
                                                                                        • Size 3KB
                                                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 37KB
                                                                                        • SHA256 604940543a6f7a960c49f5ae46d5c99ff660f2f8913943b9ec0f07eb6ef9db99
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 39KB
                                                                                        • SHA256 69ce407815924f65de6fda20c79eda7a2f305a93e11942a6d0de6eb03aa5b9f4
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 34KB
                                                                                        • SHA256 06ffb5383fc3fb287fdfc84aaa62c6896835e1b5774e34b25ee0016b8a6c96e4
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 34KB
                                                                                        • SHA256 e7de20248ecf6ffdbb9e50cc8b9c2b35fcc7c6a645be147633a20ab59129aad7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 37KB
                                                                                        • SHA256 42b5ff9255b86dbf695580556b22b62c58935ebb196c9e9eab0c47f09dad3c85
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        metadata.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                        • Size 252B
                                                                                        • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        metadata.json
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                        • Size 132B
                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        62a52ff0-d984-467e-a929-d52df2f6cc3f.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62a52ff0-d984-467e-a929-d52df2f6cc3f.tmp
                                                                                        • Size 13B
                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        hao.360[1].xml
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UKMG5M00\hao.360[1].xml
                                                                                        • Size 2KB
                                                                                        • SHA256 0fb2f5def63512b03056412a36e8475e15528223ba6f2d2f84c9bcfa728ee972
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        hao.360[1].xml
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UKMG5M00\hao.360[1].xml
                                                                                        • Size 55KB
                                                                                        • SHA256 eedb4df6e55d21b43deb0103f46abf79ab582208924c0f5b263543a5e091fc92
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        113[1].js
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\10ERUZGJ\113[1].js
                                                                                        • Size 61KB
                                                                                        • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        time[1].js
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1MCKQ809\time[1].js
                                                                                        • Size 27B
                                                                                        • SHA256 6e6b1df4efa7e8437eae37dbdd702746cd33ef69d64ec921d8838c1fde1192ca
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        QHCmHelp1.0.0.1[1].cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q72YYD0X\QHCmHelp1.0.0.1[1].cab
                                                                                        • Size 199KB
                                                                                        • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        sed_api_weather_info[1].htm
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q72YYD0X\sed_api_weather_info[1].htm
                                                                                        • Size 8KB
                                                                                        • SHA256 87df92af939262a7440a1b43240f05e9af9cabdb9282b6f8767ecec09c3a36e3
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        jwbayr.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\jwbayr.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 a60f27607d461dee2bf5a761c32a4703f2581d6b5c3a07fb525c567fb2b77626
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        ldsajdklsajdlkjsalkda.bat
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                        • Size 589B
                                                                                        • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        content_new.js
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5640_240398868\CRX_INSTALL\content_new.js
                                                                                        • Size 10KB
                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        055270.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\055270.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 9c93bc1bc2322985465685660ee7f8b52e874ad3245694593a3b3ee8a4b47614
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        062602.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\062602.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 4d8cc5a3106e33bbeddc0dd654a1f0e3be038075dbb1e38a037f6871bf520ce1
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        173394.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\173394.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 816e167d9c56f56ce2654c76057237abc84c3d3f42b1d453ba51138739e90694
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        201294.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\201294.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 0e6971bdf38897a6bee36a3746b511e05d02427b18f55b6a9e2be5dd55e7b61f
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        221321.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\221321.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 406ca2c111c6bbab46b1c4bffd6ebd1f74345ada1718f97b76b89acdc13733bd
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        391942.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\391942.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 dd9d5cd5d9e9d7874592a21570bd6b8fd370a1cf48a08bd67fb6b258c601646f
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        470290.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\470290.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 8a808bb558d35de8ab56e130aa648cf85037294d7a90787b7dcd9143a5f0a7ef
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        560193.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\560193.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 2430f6c74f8b6ec1d06ccf32a8e3b863472c79c97cafd533655ac9e0a97a1f5b
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        609655.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\609655.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 29928d0337fc28cbb915e5849806733c1cc29dbb9f5c17c53f760d261b5be953
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        677925.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\677925.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 62e1af6e574d70b2ca3092fe5f677e902b0c323ec2921cc2378078874e0f841e
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        694273.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\694273.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 29e7908e0775922490bca6bfbd663a84287ad772d501c95d8d0888dac72bc5ca
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        752073.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\752073.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 c7e923a5d2b157429d3bfd49e1d0380d2b83ff5e140d82f0c4c7d5d0cad225b9
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        861914.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\861914.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 cd4b79a68625c5b99bcef2394c50fd5e7c4b1da68bed4cb0e8ef0dc1a4a02880
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        900896.exe
                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\900896.exe
                                                                                        • Size 1.5MB
                                                                                        • SHA256 235da738e55395ea1b29f38ed29cf1c2b82549d1de2861528ce029d84836b74e
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        memory/4128-19-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4456-181-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4672-566-0x0000000003820000-0x0000000003A7F000-memory.dmp
                                                                                        Download

                                                                                        memory/4672-928-0x0000000003820000-0x0000000003A7F000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-918-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-961-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-285-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-880-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1014-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1055-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-820-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1101-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1130-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1175-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-655-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1221-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download

                                                                                        memory/4784-1266-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                        Download