Overview

overview

7

Static

static

3

2026-10-02...op.exe

windows10-2004-x64

7

2026-10-02...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/10/2026, 13:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_49de2929de3409bd5a934a810465338b_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261003-qjdl3azala
  • SHA256 aa9208a0f4c80827028c4670044f9ecf91f567b7446ecefc8ca1985bdabbe7b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_49de2929de3409bd5a934a810465338b_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_49de2929de3409bd5a934a810465338b_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2500
    • C:\Users\Admin\AppData\Local\Temp\tnzjba.exe
      "C:\Users\Admin\AppData\Local\Temp\tnzjba.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4820
      • C:\Users\Admin\AppData\Local\Temp\tnzjba.exe
        "C:\Users\Admin\AppData\Local\Temp\tnzjba.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Users\Admin\AppData\Roaming\Download\737959.exe
          "C:\Users\Admin\AppData\Roaming\Download\737959.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Users\Admin\AppData\Roaming\Download\737959.exe
            "C:\Users\Admin\AppData\Roaming\Download\737959.exe"
            5⤵
            • Executes dropped EXE
            PID:3380
        • C:\Users\Admin\AppData\Roaming\Download\532304.exe
          "C:\Users\Admin\AppData\Roaming\Download\532304.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3376
          • C:\Users\Admin\AppData\Roaming\Download\532304.exe
            "C:\Users\Admin\AppData\Roaming\Download\532304.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3080
        • C:\Users\Admin\AppData\Roaming\Download\788387.exe
          "C:\Users\Admin\AppData\Roaming\Download\788387.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5764
          • C:\Users\Admin\AppData\Roaming\Download\788387.exe
            "C:\Users\Admin\AppData\Roaming\Download\788387.exe"
            5⤵
            • Executes dropped EXE
            PID:5960
        • C:\Users\Admin\AppData\Roaming\Download\813549.exe
          "C:\Users\Admin\AppData\Roaming\Download\813549.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5316
          • C:\Users\Admin\AppData\Roaming\Download\813549.exe
            "C:\Users\Admin\AppData\Roaming\Download\813549.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5448
        • C:\Users\Admin\AppData\Roaming\Download\101367.exe
          "C:\Users\Admin\AppData\Roaming\Download\101367.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4000
          • C:\Users\Admin\AppData\Roaming\Download\101367.exe
            "C:\Users\Admin\AppData\Roaming\Download\101367.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5464
        • C:\Users\Admin\AppData\Roaming\Download\202798.exe
          "C:\Users\Admin\AppData\Roaming\Download\202798.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5608
          • C:\Users\Admin\AppData\Roaming\Download\202798.exe
            "C:\Users\Admin\AppData\Roaming\Download\202798.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5924
        • C:\Users\Admin\AppData\Roaming\Download\479506.exe
          "C:\Users\Admin\AppData\Roaming\Download\479506.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5940
          • C:\Users\Admin\AppData\Roaming\Download\479506.exe
            "C:\Users\Admin\AppData\Roaming\Download\479506.exe"
            5⤵
            • Executes dropped EXE
            PID:5892
        • C:\Users\Admin\AppData\Roaming\Download\625568.exe
          "C:\Users\Admin\AppData\Roaming\Download\625568.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4788
          • C:\Users\Admin\AppData\Roaming\Download\625568.exe
            "C:\Users\Admin\AppData\Roaming\Download\625568.exe"
            5⤵
            • Executes dropped EXE
            PID:4700
        • C:\Users\Admin\AppData\Roaming\Download\604112.exe
          "C:\Users\Admin\AppData\Roaming\Download\604112.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5280
          • C:\Users\Admin\AppData\Roaming\Download\604112.exe
            "C:\Users\Admin\AppData\Roaming\Download\604112.exe"
            5⤵
            • Executes dropped EXE
            PID:5384
        • C:\Users\Admin\AppData\Roaming\Download\995717.exe
          "C:\Users\Admin\AppData\Roaming\Download\995717.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5372
          • C:\Users\Admin\AppData\Roaming\Download\995717.exe
            "C:\Users\Admin\AppData\Roaming\Download\995717.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5556
        • C:\Users\Admin\AppData\Roaming\Download\383421.exe
          "C:\Users\Admin\AppData\Roaming\Download\383421.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5924
          • C:\Users\Admin\AppData\Roaming\Download\383421.exe
            "C:\Users\Admin\AppData\Roaming\Download\383421.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5636
        • C:\Users\Admin\AppData\Roaming\Download\516707.exe
          "C:\Users\Admin\AppData\Roaming\Download\516707.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5208
          • C:\Users\Admin\AppData\Roaming\Download\516707.exe
            "C:\Users\Admin\AppData\Roaming\Download\516707.exe"
            5⤵
            • Executes dropped EXE
            PID:5312
        • C:\Users\Admin\AppData\Roaming\Download\804664.exe
          "C:\Users\Admin\AppData\Roaming\Download\804664.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2080
          • C:\Users\Admin\AppData\Roaming\Download\804664.exe
            "C:\Users\Admin\AppData\Roaming\Download\804664.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2420
        • C:\Users\Admin\AppData\Roaming\Download\542453.exe
          "C:\Users\Admin\AppData\Roaming\Download\542453.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4416
          • C:\Users\Admin\AppData\Roaming\Download\542453.exe
            "C:\Users\Admin\AppData\Roaming\Download\542453.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5384
        • C:\Users\Admin\AppData\Roaming\Download\939471.exe
          "C:\Users\Admin\AppData\Roaming\Download\939471.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5568
          • C:\Users\Admin\AppData\Roaming\Download\939471.exe
            "C:\Users\Admin\AppData\Roaming\Download\939471.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2068
        • C:\Users\Admin\AppData\Roaming\Download\830602.exe
          "C:\Users\Admin\AppData\Roaming\Download\830602.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5660
          • C:\Users\Admin\AppData\Roaming\Download\830602.exe
            "C:\Users\Admin\AppData\Roaming\Download\830602.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4228
        • C:\Users\Admin\AppData\Roaming\Download\107419.exe
          "C:\Users\Admin\AppData\Roaming\Download\107419.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5428
          • C:\Users\Admin\AppData\Roaming\Download\107419.exe
            "C:\Users\Admin\AppData\Roaming\Download\107419.exe"
            5⤵
            • Executes dropped EXE
            PID:5476
        • C:\Users\Admin\AppData\Roaming\Download\453672.exe
          "C:\Users\Admin\AppData\Roaming\Download\453672.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3856
          • C:\Users\Admin\AppData\Roaming\Download\453672.exe
            "C:\Users\Admin\AppData\Roaming\Download\453672.exe"
            5⤵
            • Executes dropped EXE
            PID:5200
        • C:\Users\Admin\AppData\Roaming\Download\476758.exe
          "C:\Users\Admin\AppData\Roaming\Download\476758.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5188
          • C:\Users\Admin\AppData\Roaming\Download\476758.exe
            "C:\Users\Admin\AppData\Roaming\Download\476758.exe"
            5⤵
            • Executes dropped EXE
            PID:5300
        • C:\Users\Admin\AppData\Roaming\Download\518024.exe
          "C:\Users\Admin\AppData\Roaming\Download\518024.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1140
          • C:\Users\Admin\AppData\Roaming\Download\518024.exe
            "C:\Users\Admin\AppData\Roaming\Download\518024.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5888
        • C:\Users\Admin\AppData\Roaming\Download\540382.exe
          "C:\Users\Admin\AppData\Roaming\Download\540382.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:228
          • C:\Users\Admin\AppData\Roaming\Download\540382.exe
            "C:\Users\Admin\AppData\Roaming\Download\540382.exe"
            5⤵
            • Executes dropped EXE
            PID:548
        • C:\Users\Admin\AppData\Roaming\Download\783448.exe
          "C:\Users\Admin\AppData\Roaming\Download\783448.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3144
          • C:\Users\Admin\AppData\Roaming\Download\783448.exe
            "C:\Users\Admin\AppData\Roaming\Download\783448.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5468
        • C:\Users\Admin\AppData\Roaming\Download\032245.exe
          "C:\Users\Admin\AppData\Roaming\Download\032245.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5032
          • C:\Users\Admin\AppData\Roaming\Download\032245.exe
            "C:\Users\Admin\AppData\Roaming\Download\032245.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5664
        • C:\Users\Admin\AppData\Roaming\Download\054501.exe
          "C:\Users\Admin\AppData\Roaming\Download\054501.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5112
          • C:\Users\Admin\AppData\Roaming\Download\054501.exe
            "C:\Users\Admin\AppData\Roaming\Download\054501.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3488
        • C:\Users\Admin\AppData\Roaming\Download\147852.exe
          "C:\Users\Admin\AppData\Roaming\Download\147852.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4632
          • C:\Users\Admin\AppData\Roaming\Download\147852.exe
            "C:\Users\Admin\AppData\Roaming\Download\147852.exe"
            5⤵
            • Executes dropped EXE
            PID:5360
        • C:\Users\Admin\AppData\Roaming\Download\180118.exe
          "C:\Users\Admin\AppData\Roaming\Download\180118.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4020
          • C:\Users\Admin\AppData\Roaming\Download\180118.exe
            "C:\Users\Admin\AppData\Roaming\Download\180118.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1472
        • C:\Users\Admin\AppData\Roaming\Download\336090.exe
          "C:\Users\Admin\AppData\Roaming\Download\336090.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4264
          • C:\Users\Admin\AppData\Roaming\Download\336090.exe
            "C:\Users\Admin\AppData\Roaming\Download\336090.exe"
            5⤵
            • Executes dropped EXE
            PID:4772
        • C:\Users\Admin\AppData\Roaming\Download\690273.exe
          "C:\Users\Admin\AppData\Roaming\Download\690273.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3360
          • C:\Users\Admin\AppData\Roaming\Download\690273.exe
            "C:\Users\Admin\AppData\Roaming\Download\690273.exe"
            5⤵
            • Executes dropped EXE
            PID:6132
        • C:\Users\Admin\AppData\Roaming\Download\336992.exe
          "C:\Users\Admin\AppData\Roaming\Download\336992.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5384
          • C:\Users\Admin\AppData\Roaming\Download\336992.exe
            "C:\Users\Admin\AppData\Roaming\Download\336992.exe"
            5⤵
            • Executes dropped EXE
            PID:3736
        • C:\Users\Admin\AppData\Roaming\Download\370058.exe
          "C:\Users\Admin\AppData\Roaming\Download\370058.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2952
          • C:\Users\Admin\AppData\Roaming\Download\370058.exe
            "C:\Users\Admin\AppData\Roaming\Download\370058.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5572
        • C:\Users\Admin\AppData\Roaming\Download\303314.exe
          "C:\Users\Admin\AppData\Roaming\Download\303314.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4120
          • C:\Users\Admin\AppData\Roaming\Download\303314.exe
            "C:\Users\Admin\AppData\Roaming\Download\303314.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:380
        • C:\Users\Admin\AppData\Roaming\Download\880112.exe
          "C:\Users\Admin\AppData\Roaming\Download\880112.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5776
          • C:\Users\Admin\AppData\Roaming\Download\880112.exe
            "C:\Users\Admin\AppData\Roaming\Download\880112.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4856
        • C:\Users\Admin\AppData\Roaming\Download\812478.exe
          "C:\Users\Admin\AppData\Roaming\Download\812478.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:916
          • C:\Users\Admin\AppData\Roaming\Download\812478.exe
            "C:\Users\Admin\AppData\Roaming\Download\812478.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5480
        • C:\Users\Admin\AppData\Roaming\Download\058450.exe
          "C:\Users\Admin\AppData\Roaming\Download\058450.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2592
          • C:\Users\Admin\AppData\Roaming\Download\058450.exe
            "C:\Users\Admin\AppData\Roaming\Download\058450.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5920
        • C:\Users\Admin\AppData\Roaming\Download\281716.exe
          "C:\Users\Admin\AppData\Roaming\Download\281716.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:2484
          • C:\Users\Admin\AppData\Roaming\Download\281716.exe
            "C:\Users\Admin\AppData\Roaming\Download\281716.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1164
        • C:\Users\Admin\AppData\Roaming\Download\949435.exe
          "C:\Users\Admin\AppData\Roaming\Download\949435.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:1880
          • C:\Users\Admin\AppData\Roaming\Download\949435.exe
            "C:\Users\Admin\AppData\Roaming\Download\949435.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5508
        • C:\Users\Admin\AppData\Roaming\Download\459965.exe
          "C:\Users\Admin\AppData\Roaming\Download\459965.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:2420
          • C:\Users\Admin\AppData\Roaming\Download\459965.exe
            "C:\Users\Admin\AppData\Roaming\Download\459965.exe"
            5⤵
              PID:1396
          • C:\Users\Admin\AppData\Roaming\Download\217574.exe
            "C:\Users\Admin\AppData\Roaming\Download\217574.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5860
            • C:\Users\Admin\AppData\Roaming\Download\217574.exe
              "C:\Users\Admin\AppData\Roaming\Download\217574.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2520
          • C:\Users\Admin\AppData\Roaming\Download\574571.exe
            "C:\Users\Admin\AppData\Roaming\Download\574571.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:1972
            • C:\Users\Admin\AppData\Roaming\Download\574571.exe
              "C:\Users\Admin\AppData\Roaming\Download\574571.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2400
          • C:\Users\Admin\AppData\Roaming\Download\485822.exe
            "C:\Users\Admin\AppData\Roaming\Download\485822.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:1492
            • C:\Users\Admin\AppData\Roaming\Download\485822.exe
              "C:\Users\Admin\AppData\Roaming\Download\485822.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5904
          • C:\Users\Admin\AppData\Roaming\Download\749913.exe
            "C:\Users\Admin\AppData\Roaming\Download\749913.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:1280
            • C:\Users\Admin\AppData\Roaming\Download\749913.exe
              "C:\Users\Admin\AppData\Roaming\Download\749913.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5468
          • C:\Users\Admin\AppData\Roaming\Download\098793.exe
            "C:\Users\Admin\AppData\Roaming\Download\098793.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:4784
            • C:\Users\Admin\AppData\Roaming\Download\098793.exe
              "C:\Users\Admin\AppData\Roaming\Download\098793.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3604
          • C:\Users\Admin\AppData\Roaming\Download\041058.exe
            "C:\Users\Admin\AppData\Roaming\Download\041058.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:1396
            • C:\Users\Admin\AppData\Roaming\Download\041058.exe
              "C:\Users\Admin\AppData\Roaming\Download\041058.exe"
              5⤵
                PID:1668
            • C:\Users\Admin\AppData\Roaming\Download\922309.exe
              "C:\Users\Admin\AppData\Roaming\Download\922309.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:4072
              • C:\Users\Admin\AppData\Roaming\Download\922309.exe
                "C:\Users\Admin\AppData\Roaming\Download\922309.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5984
            • C:\Users\Admin\AppData\Roaming\Download\512014.exe
              "C:\Users\Admin\AppData\Roaming\Download\512014.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:3680
              • C:\Users\Admin\AppData\Roaming\Download\512014.exe
                "C:\Users\Admin\AppData\Roaming\Download\512014.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5216
            • C:\Users\Admin\AppData\Roaming\Download\269284.exe
              "C:\Users\Admin\AppData\Roaming\Download\269284.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5356
              • C:\Users\Admin\AppData\Roaming\Download\269284.exe
                "C:\Users\Admin\AppData\Roaming\Download\269284.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5988
            • C:\Users\Admin\AppData\Roaming\Download\894189.exe
              "C:\Users\Admin\AppData\Roaming\Download\894189.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5528
              • C:\Users\Admin\AppData\Roaming\Download\894189.exe
                "C:\Users\Admin\AppData\Roaming\Download\894189.exe"
                5⤵
                  PID:4808
              • C:\Users\Admin\AppData\Roaming\Download\036445.exe
                "C:\Users\Admin\AppData\Roaming\Download\036445.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3000
                • C:\Users\Admin\AppData\Roaming\Download\036445.exe
                  "C:\Users\Admin\AppData\Roaming\Download\036445.exe"
                  5⤵
                    PID:5720
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
              2⤵
              • Drops file in Program Files directory
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2780
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ff93139c188,0x7ff93139c194,0x7ff93139c1a0
                3⤵
                  PID:4800
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,7799482406508245698,6716525527823145552,262144 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
                  3⤵
                    PID:3840
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,7605332659010768497,14556678182352268465,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
                    3⤵
                    • System Time Discovery
                    PID:4944
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15930239674697986178,12703191700728181039,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
                    3⤵
                      PID:2292
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,9795249228526541047,12625236347637927709,2097152 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                      3⤵
                        PID:3928
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,4185707633821539361,9089126003398218739,2097152 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                        3⤵
                          PID:4828
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1856,i,17644993331696132959,10514736223018374803,2097152 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                          3⤵
                            PID:1904
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,1661716392763323063,10850042889550127983,2097152 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
                            3⤵
                              PID:2424
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,7577337219136189614,4480932546552990861,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
                              3⤵
                                PID:4804
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1733846532384575464,6623917130259587536,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
                                3⤵
                                  PID:2228
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,3923289323015926555,17703453277417391362,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
                                  3⤵
                                    PID:2068
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,6272907666170497602,6467041651338840104,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                                    3⤵
                                      PID:3080
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,7035699222848258491,3640030279950455950,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
                                      3⤵
                                        PID:2348
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,7035699222848258491,3640030279950455950,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
                                        3⤵
                                          PID:4264
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12141072051500856234,14168476841179819978,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
                                          3⤵
                                            PID:5412
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8484248431845524417,7379703654301809053,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
                                            3⤵
                                              PID:5420
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,8915249499515226488,11985448058486176986,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
                                              3⤵
                                                PID:5188
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,10901613819304488216,7463516686387668139,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
                                                3⤵
                                                  PID:5200
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6548,i,16162266683543331403,1977578991173079522,2097152 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
                                                  3⤵
                                                    PID:5856
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,12976231853259465865,11903204978854368217,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
                                                    3⤵
                                                      PID:6060
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,3999443821101560603,13207897976984582124,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
                                                      3⤵
                                                        PID:5960
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,3423447049560951723,4860836361080577576,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
                                                        3⤵
                                                        • Modifies registry class
                                                        PID:6000
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3768,i,11639118835215336253,5146825401103092618,2097152 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
                                                        3⤵
                                                          PID:5576
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,3506053903756796363,11631288633825172290,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
                                                          3⤵
                                                            PID:4264
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,16359464863859345595,10499644207789283740,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
                                                            3⤵
                                                              PID:5796
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,9650462827517580353,16229397142031193004,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
                                                              3⤵
                                                                PID:4168
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,12750681658833849969,12801876742187395637,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
                                                                3⤵
                                                                  PID:5744
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1015500312454103762,17479791900650128932,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                                                                  3⤵
                                                                    PID:3348
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,2183369555116875992,11450372989603506384,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                                                    3⤵
                                                                      PID:5508
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,13262201730538924567,10338118134780091212,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                                                      3⤵
                                                                        PID:5508
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,1610948415028372360,9647101583491215272,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
                                                                        3⤵
                                                                          PID:996
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7080,i,12487157588749446773,2918923612454885567,262144 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
                                                                          3⤵
                                                                            PID:5196
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,4893334078451943192,16194766469149586352,524288 --field-trial-handle=2324,i,5645935694820096431,17552049275550974236,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
                                                                            3⤵
                                                                              PID:4676
                                                                          • C:\Windows\explorer.exe
                                                                            "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                            2⤵
                                                                              PID:4012
                                                                          • C:\Windows\explorer.exe
                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                            1⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1216
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                              2⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:780
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                            1⤵
                                                                              PID:1552
                                                                            • C:\Windows\system32\backgroundTaskHost.exe
                                                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                              1⤵
                                                                                PID:4168

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    DouTuDaShi.exe
                                                                                    • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                    • Size 1.1MB
                                                                                    • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    llm_user_input_extractor_config.json
                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2780_1494379807\llm_user_input_extractor_config.json
                                                                                    • Size 4KB
                                                                                    • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    office_endpoints_list.json
                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2780_1494379807\office_endpoints_list.json
                                                                                    • Size 9KB
                                                                                    • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    smart_switch_list.json
                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2780_1494379807\smart_switch_list.json
                                                                                    • Size 2KB
                                                                                    • SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    nav_config.json
                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2780_224173394\nav_config.json
                                                                                    • Size 2KB
                                                                                    • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    protocols.json
                                                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2780_368088999\protocols.json
                                                                                    • Size 3KB
                                                                                    • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    2cf44a6e-0f48-449a-9b3f-cb8471081077.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2cf44a6e-0f48-449a-9b3f-cb8471081077.tmp
                                                                                    • Size 28KB
                                                                                    • SHA256 46992c679332a6c39d255a90ba144d9aee8b4c584ab026c744a25c641aef3829
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    manifest.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                    • Size 135B
                                                                                    • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    12b08a4e-803d-4806-b725-93a3d2738242.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12b08a4e-803d-4806-b725-93a3d2738242.tmp
                                                                                    • Size 11KB
                                                                                    • SHA256 2915d51711ee981db67912900df36204a2911f6c14ca772c4ef92f9749f24030
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    32b920cf-66da-4ddc-bf26-e3d5cdc48750.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32b920cf-66da-4ddc-bf26-e3d5cdc48750.tmp
                                                                                    • Size 70KB
                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    4771b462-7e15-4978-b3de-04f629da3e33.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4771b462-7e15-4978-b3de-04f629da3e33.tmp
                                                                                    • Size 11KB
                                                                                    • SHA256 b3e1a3345400a39939d7776fac2b3c687191ff2e46518c7e4b45987c0755cdbe
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    5377ac79-41d8-40ca-8cca-d7516d013d2c.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5377ac79-41d8-40ca-8cca-d7516d013d2c.tmp
                                                                                    • Size 32KB
                                                                                    • SHA256 16ebdcc0beb9ef74fbb3b9054a8847a71cb7af1008907dcb7f6c08c26b2b980f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    LOG.old
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                    • Size 334B
                                                                                    • SHA256 44998b9cd76f02293cb3ec73f0d95c0015bad31c99b0322cec98cd1cf5287b32
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    f_000070
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
                                                                                    • Size 61KB
                                                                                    • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    96f9b4f9adf74a24_0
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                    • Size 213B
                                                                                    • SHA256 04335c6d1cdf6ad725eae06c34ea8ebf5c13d5684e45e468edac81af71c754cb
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    a778f3c2e962d2a7_0
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a778f3c2e962d2a7_0
                                                                                    • Size 223B
                                                                                    • SHA256 01bba823e81b6322fd9f212fcd2764df1ace3ac169bec9163f582bb003fd65c0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    df36dda3fc61f9c6_0
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df36dda3fc61f9c6_0
                                                                                    • Size 219B
                                                                                    • SHA256 a364905de145c2b7db9a836cb59fe03883a6012f886277198e3bf843ca948abc
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    temp-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                    • Size 4KB
                                                                                    • SHA256 a31c1b272e8a99a113f31a333a758e7b2ac3df7bc103e5575db67471cf28d26d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 3KB
                                                                                    • SHA256 731248231b0ee7351f2d2632f9c262354b2fe938f834cb0434159b6bb0670580
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    91ab8338-de83-45b6-9066-ee75bdf12af2.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\91ab8338-de83-45b6-9066-ee75bdf12af2.tmp
                                                                                    • Size 2B
                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    dasherSettingSchema.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
                                                                                    • Size 854B
                                                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    a491d4b3-64fe-4aea-9590-9602488eb683.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a491d4b3-64fe-4aea-9590-9602488eb683.tmp
                                                                                    • Size 111B
                                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    b077fd53-6fa0-4d08-a554-67526a19e57d.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b077fd53-6fa0-4d08-a554-67526a19e57d.tmp
                                                                                    • Size 2B
                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    e27b4c55-2420-4cf3-a44d-75cea044c60d.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e27b4c55-2420-4cf3-a44d-75cea044c60d.tmp
                                                                                    • Size 111B
                                                                                    • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    ff8f04fa-1300-4470-99be-9586b4e6d125.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff8f04fa-1300-4470-99be-9586b4e6d125.tmp
                                                                                    • Size 6KB
                                                                                    • SHA256 c63f5637d1338403cf7c57a5bd021ac04d444187e945c7405a7014f92d664393
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    sync_diagnostic.log
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                    • Size 4KB
                                                                                    • SHA256 2eaa03351ecee2d7ee326152142b1bd617ca064e5925b6d5162ff1194ae01778
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    d89c1b3c-f35d-4bfe-8b26-b980b1dcc3a2.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d89c1b3c-f35d-4bfe-8b26-b980b1dcc3a2.tmp
                                                                                    • Size 11KB
                                                                                    • SHA256 6b3365214bb1ad231dc2cc884eca0ffe7fe104ed52bea61b55ee9d44cd6d29bf
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    OperationConfig
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                    • Size 3KB
                                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    b39df4cc-ff55-4a41-b5f6-376b36e75a4a.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b39df4cc-ff55-4a41-b5f6-376b36e75a4a.tmp
                                                                                    • Size 22KB
                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    manifest.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
                                                                                    • Size 165B
                                                                                    • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    manifest.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                    • Size 43B
                                                                                    • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    manifest.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                    • Size 160B
                                                                                    • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    cd878093-2e86-4f15-99f2-e3e3fb498c76.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd878093-2e86-4f15-99f2-e3e3fb498c76.tmp
                                                                                    • Size 18KB
                                                                                    • SHA256 b0b7ec8052ea47fe9f78a89f8fff6622802bee0bcb57f2442581fb0fc78708ac
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    02b4b155-63cb-4177-be60-c8bc0164a178.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\02b4b155-63cb-4177-be60-c8bc0164a178.tmp
                                                                                    • Size 252B
                                                                                    • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    3d1fb949-36ef-4d87-b655-5e76e72e2710.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3d1fb949-36ef-4d87-b655-5e76e72e2710.tmp
                                                                                    • Size 372B
                                                                                    • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    9ea2a247-24ba-4815-bab2-4f9d5955cc15.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9ea2a247-24ba-4815-bab2-4f9d5955cc15.tmp
                                                                                    • Size 132B
                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    d8bcee90-9212-43b0-a7a4-fe41024d6ecc.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8bcee90-9212-43b0-a7a4-fe41024d6ecc.tmp
                                                                                    • Size 18KB
                                                                                    • SHA256 e8306cce9d4bf9cbf9707a8bdb5eaaac6fb6e162daa1d43da655bd9148388c13
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    e60b79ab-8c2d-41c5-8912-c4c98c3ef958.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e60b79ab-8c2d-41c5-8912-c4c98c3ef958.tmp
                                                                                    • Size 8KB
                                                                                    • SHA256 9a296219495fcb378754a70d4e540bd1449309f3fb949988aad8dafd82904e83
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ea9f84ab-59c6-40e5-bd95-7d6996ac451b.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea9f84ab-59c6-40e5-bd95-7d6996ac451b.tmp
                                                                                    • Size 8KB
                                                                                    • SHA256 d8ade88e33c57da05576fd70d4ea1e42e5037161dca559847ba6d4bb27599db7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    e0a0a806-890f-4f03-970d-3e6289e652b5.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0a0a806-890f-4f03-970d-3e6289e652b5.tmp
                                                                                    • Size 13B
                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    hao.360[1].xml
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SOXDD53B\hao.360[1].xml
                                                                                    • Size 852B
                                                                                    • SHA256 f52c6a1d8825a94bf3b5e0a0fac81836dad93be66048d8fc7cbb0f4bf69479fb
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    hao.360[1].xml
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SOXDD53B\hao.360[1].xml
                                                                                    • Size 49KB
                                                                                    • SHA256 6eb354a85045652c6e4cd8f1d98a0004e70dd2c7126ab3ad70509f20ff88fd37
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    hao.360[1].xml
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SOXDD53B\hao.360[1].xml
                                                                                    • Size 54KB
                                                                                    • SHA256 812e1feeedd82b614755773967d90b25a7e2797683a120d4015a164e63df4a7c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                    • Size 2KB
                                                                                    • SHA256 a3035ba05f8e9f03b4f1a53e640af413a0617d81ef2273a9b32725fb36758dc7
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    behavior[2].htm
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5FBHLEWR\behavior[2].htm
                                                                                    • Size 43B
                                                                                    • SHA256 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    QHCmHelp1.0.0.1[1].cab
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U3DRQ2XJ\QHCmHelp1.0.0.1[1].cab
                                                                                    • Size 199KB
                                                                                    • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    time[1].js
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U3DRQ2XJ\time[1].js
                                                                                    • Size 27B
                                                                                    • SHA256 2dcbeb5ecb8044869e26ef63a7e4b368596d5ea4ec7792ffea46a1b4e074ca89
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    2a20a70f-3df7-4942-afae-efd46d238c98.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2a20a70f-3df7-4942-afae-efd46d238c98.tmp
                                                                                    • Size 1B
                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    6646a07a-365d-41a8-ac8c-833b87d5933d.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6646a07a-365d-41a8-ac8c-833b87d5933d.tmp
                                                                                    • Size 157KB
                                                                                    • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ldsajdklsajdlkjsalkda.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                    • Size 589B
                                                                                    • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    content.js
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2780_1664955068\CRX_INSTALL\content.js
                                                                                    • Size 9KB
                                                                                    • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    de819117-46bc-4bcc-98a4-d0a4a0588d5c.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2780_1664955068\de819117-46bc-4bcc-98a4-d0a4a0588d5c.tmp
                                                                                    • Size 10KB
                                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    messages.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2780_1819126623\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                    • Size 711B
                                                                                    • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    tnzjba.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tnzjba.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 aa9208a0f4c80827028c4670044f9ecf91f567b7446ecefc8ca1985bdabbe7b4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    101367.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\101367.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 803409a3d7470fb8ff0837bbfab30c21c62d5a19e477aab53ee01eac22e39d51
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    202798.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\202798.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 8539b3fff66e71beaa2e5f953b46472b5b08c4768f31b087b49b8ea60ea25669
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    383421.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\383421.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 68012e1d5ee59498ca9e63bbd37fedee9668ad0c54e39edcdf299a0fde4f748e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    479506.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\479506.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 933cd567d340f20cb36c32c6d77695aba3b7661dc29f293cdd545cba50b1a547
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    516707.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\516707.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 0d01e6dfc42a6f1d23a671286277fda9ffe610cf390ba36e8b3cd533d2fd3ac1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    532304.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\532304.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 b9e147228e50f206f73d5451c12b0eafdd7a85f269d333533f935c58b5f44e9d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    604112.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\604112.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 aa9b77603540f81040574bbf3138864679384b4842ec89f8909e6488ff0fe902
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    625568.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\625568.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 ae5746c571fa79999b3c5c4be6f3840acc89d8cb8c66d236220cdcd06ede7eae
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    737959.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\737959.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 afeb66665815e6fff239423404d12015d6ad76aa464b1b39c85eb3c6d904bed1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    788387.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\788387.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 2e15daa49e19500062c1a79b5b21f702a2f96e575bf8c66e78ceb8a40b1b3d0e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    813549.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\813549.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 be275429f9423478b7f0da7ff5d1f47fcde42cc2a106c1d48d273db7a0b79428
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    995717.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\995717.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 869ef59d0caa49ab782e6aa848eb476638e7cef71f808449bb3709d652cafac7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    memory/4448-1605-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-982-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1548-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1307-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-384-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1449-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1132-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1659-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1694-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1379-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1505-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4448-1210-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4744-298-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download