Overview

overview

7

Static

static

3

2026-10-06...op.exe

windows10-2004-x64

7

2026-10-06...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/10/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-06_1def9a5abe61b32782bea7e16479b7a8_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261006-sdqqjs1vas
  • SHA256 05d6c859953127e19b3f3c9d964952ed3bcc75f6a962d3e21dc5f45f9b65aa63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 50 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_1def9a5abe61b32782bea7e16479b7a8_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-06_1def9a5abe61b32782bea7e16479b7a8_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4508
    • C:\Users\Admin\AppData\Local\Temp\snewhx.exe
      "C:\Users\Admin\AppData\Local\Temp\snewhx.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\snewhx.exe
        "C:\Users\Admin\AppData\Local\Temp\snewhx.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Users\Admin\AppData\Roaming\Download\482539.exe
          "C:\Users\Admin\AppData\Roaming\Download\482539.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1660
          • C:\Users\Admin\AppData\Roaming\Download\482539.exe
            "C:\Users\Admin\AppData\Roaming\Download\482539.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:452
        • C:\Users\Admin\AppData\Roaming\Download\345233.exe
          "C:\Users\Admin\AppData\Roaming\Download\345233.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Users\Admin\AppData\Roaming\Download\345233.exe
            "C:\Users\Admin\AppData\Roaming\Download\345233.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3560
        • C:\Users\Admin\AppData\Roaming\Download\217290.exe
          "C:\Users\Admin\AppData\Roaming\Download\217290.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5560
          • C:\Users\Admin\AppData\Roaming\Download\217290.exe
            "C:\Users\Admin\AppData\Roaming\Download\217290.exe"
            5⤵
            • Executes dropped EXE
            PID:5804
        • C:\Users\Admin\AppData\Roaming\Download\919721.exe
          "C:\Users\Admin\AppData\Roaming\Download\919721.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5372
          • C:\Users\Admin\AppData\Roaming\Download\919721.exe
            "C:\Users\Admin\AppData\Roaming\Download\919721.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5508
        • C:\Users\Admin\AppData\Roaming\Download\109246.exe
          "C:\Users\Admin\AppData\Roaming\Download\109246.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2692
          • C:\Users\Admin\AppData\Roaming\Download\109246.exe
            "C:\Users\Admin\AppData\Roaming\Download\109246.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4864
        • C:\Users\Admin\AppData\Roaming\Download\225209.exe
          "C:\Users\Admin\AppData\Roaming\Download\225209.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6044
          • C:\Users\Admin\AppData\Roaming\Download\225209.exe
            "C:\Users\Admin\AppData\Roaming\Download\225209.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5460
        • C:\Users\Admin\AppData\Roaming\Download\825913.exe
          "C:\Users\Admin\AppData\Roaming\Download\825913.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5088
          • C:\Users\Admin\AppData\Roaming\Download\825913.exe
            "C:\Users\Admin\AppData\Roaming\Download\825913.exe"
            5⤵
            • Executes dropped EXE
            PID:3120
        • C:\Users\Admin\AppData\Roaming\Download\112720.exe
          "C:\Users\Admin\AppData\Roaming\Download\112720.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5756
          • C:\Users\Admin\AppData\Roaming\Download\112720.exe
            "C:\Users\Admin\AppData\Roaming\Download\112720.exe"
            5⤵
            • Executes dropped EXE
            PID:2848
        • C:\Users\Admin\AppData\Roaming\Download\094159.exe
          "C:\Users\Admin\AppData\Roaming\Download\094159.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5892
          • C:\Users\Admin\AppData\Roaming\Download\094159.exe
            "C:\Users\Admin\AppData\Roaming\Download\094159.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6088
        • C:\Users\Admin\AppData\Roaming\Download\236417.exe
          "C:\Users\Admin\AppData\Roaming\Download\236417.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1784
          • C:\Users\Admin\AppData\Roaming\Download\236417.exe
            "C:\Users\Admin\AppData\Roaming\Download\236417.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3804
        • C:\Users\Admin\AppData\Roaming\Download\016871.exe
          "C:\Users\Admin\AppData\Roaming\Download\016871.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3692
          • C:\Users\Admin\AppData\Roaming\Download\016871.exe
            "C:\Users\Admin\AppData\Roaming\Download\016871.exe"
            5⤵
            • Executes dropped EXE
            PID:5168
        • C:\Users\Admin\AppData\Roaming\Download\203869.exe
          "C:\Users\Admin\AppData\Roaming\Download\203869.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5960
          • C:\Users\Admin\AppData\Roaming\Download\203869.exe
            "C:\Users\Admin\AppData\Roaming\Download\203869.exe"
            5⤵
            • Executes dropped EXE
            PID:3860
        • C:\Users\Admin\AppData\Roaming\Download\525925.exe
          "C:\Users\Admin\AppData\Roaming\Download\525925.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5040
          • C:\Users\Admin\AppData\Roaming\Download\525925.exe
            "C:\Users\Admin\AppData\Roaming\Download\525925.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5932
        • C:\Users\Admin\AppData\Roaming\Download\426476.exe
          "C:\Users\Admin\AppData\Roaming\Download\426476.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5136
          • C:\Users\Admin\AppData\Roaming\Download\426476.exe
            "C:\Users\Admin\AppData\Roaming\Download\426476.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3120
        • C:\Users\Admin\AppData\Roaming\Download\694273.exe
          "C:\Users\Admin\AppData\Roaming\Download\694273.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5968
          • C:\Users\Admin\AppData\Roaming\Download\694273.exe
            "C:\Users\Admin\AppData\Roaming\Download\694273.exe"
            5⤵
            • Executes dropped EXE
            PID:6112
        • C:\Users\Admin\AppData\Roaming\Download\708511.exe
          "C:\Users\Admin\AppData\Roaming\Download\708511.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5640
          • C:\Users\Admin\AppData\Roaming\Download\708511.exe
            "C:\Users\Admin\AppData\Roaming\Download\708511.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5056
        • C:\Users\Admin\AppData\Roaming\Download\062512.exe
          "C:\Users\Admin\AppData\Roaming\Download\062512.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4576
          • C:\Users\Admin\AppData\Roaming\Download\062512.exe
            "C:\Users\Admin\AppData\Roaming\Download\062512.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5932
        • C:\Users\Admin\AppData\Roaming\Download\321311.exe
          "C:\Users\Admin\AppData\Roaming\Download\321311.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5400
          • C:\Users\Admin\AppData\Roaming\Download\321311.exe
            "C:\Users\Admin\AppData\Roaming\Download\321311.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5172
        • C:\Users\Admin\AppData\Roaming\Download\508309.exe
          "C:\Users\Admin\AppData\Roaming\Download\508309.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3668
          • C:\Users\Admin\AppData\Roaming\Download\508309.exe
            "C:\Users\Admin\AppData\Roaming\Download\508309.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5184
        • C:\Users\Admin\AppData\Roaming\Download\586733.exe
          "C:\Users\Admin\AppData\Roaming\Download\586733.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2484
          • C:\Users\Admin\AppData\Roaming\Download\586733.exe
            "C:\Users\Admin\AppData\Roaming\Download\586733.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5780
        • C:\Users\Admin\AppData\Roaming\Download\479184.exe
          "C:\Users\Admin\AppData\Roaming\Download\479184.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6000
          • C:\Users\Admin\AppData\Roaming\Download\479184.exe
            "C:\Users\Admin\AppData\Roaming\Download\479184.exe"
            5⤵
            • Executes dropped EXE
            PID:2752
        • C:\Users\Admin\AppData\Roaming\Download\614146.exe
          "C:\Users\Admin\AppData\Roaming\Download\614146.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2460
          • C:\Users\Admin\AppData\Roaming\Download\614146.exe
            "C:\Users\Admin\AppData\Roaming\Download\614146.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1368
        • C:\Users\Admin\AppData\Roaming\Download\867422.exe
          "C:\Users\Admin\AppData\Roaming\Download\867422.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5804
          • C:\Users\Admin\AppData\Roaming\Download\867422.exe
            "C:\Users\Admin\AppData\Roaming\Download\867422.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2104
        • C:\Users\Admin\AppData\Roaming\Download\889798.exe
          "C:\Users\Admin\AppData\Roaming\Download\889798.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4076
          • C:\Users\Admin\AppData\Roaming\Download\889798.exe
            "C:\Users\Admin\AppData\Roaming\Download\889798.exe"
            5⤵
            • Executes dropped EXE
            PID:828
        • C:\Users\Admin\AppData\Roaming\Download\035771.exe
          "C:\Users\Admin\AppData\Roaming\Download\035771.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3904
          • C:\Users\Admin\AppData\Roaming\Download\035771.exe
            "C:\Users\Admin\AppData\Roaming\Download\035771.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5780
        • C:\Users\Admin\AppData\Roaming\Download\361633.exe
          "C:\Users\Admin\AppData\Roaming\Download\361633.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5828
          • C:\Users\Admin\AppData\Roaming\Download\361633.exe
            "C:\Users\Admin\AppData\Roaming\Download\361633.exe"
            5⤵
            • Executes dropped EXE
            PID:6060
        • C:\Users\Admin\AppData\Roaming\Download\303919.exe
          "C:\Users\Admin\AppData\Roaming\Download\303919.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3128
          • C:\Users\Admin\AppData\Roaming\Download\303919.exe
            "C:\Users\Admin\AppData\Roaming\Download\303919.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5492
        • C:\Users\Admin\AppData\Roaming\Download\426075.exe
          "C:\Users\Admin\AppData\Roaming\Download\426075.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6024
          • C:\Users\Admin\AppData\Roaming\Download\426075.exe
            "C:\Users\Admin\AppData\Roaming\Download\426075.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2568
        • C:\Users\Admin\AppData\Roaming\Download\613073.exe
          "C:\Users\Admin\AppData\Roaming\Download\613073.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2448
          • C:\Users\Admin\AppData\Roaming\Download\613073.exe
            "C:\Users\Admin\AppData\Roaming\Download\613073.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5188
        • C:\Users\Admin\AppData\Roaming\Download\794324.exe
          "C:\Users\Admin\AppData\Roaming\Download\794324.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2488
          • C:\Users\Admin\AppData\Roaming\Download\794324.exe
            "C:\Users\Admin\AppData\Roaming\Download\794324.exe"
            5⤵
            • Executes dropped EXE
            PID:1564
        • C:\Users\Admin\AppData\Roaming\Download\339760.exe
          "C:\Users\Admin\AppData\Roaming\Download\339760.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1492
          • C:\Users\Admin\AppData\Roaming\Download\339760.exe
            "C:\Users\Admin\AppData\Roaming\Download\339760.exe"
            5⤵
              PID:5104
          • C:\Users\Admin\AppData\Roaming\Download\096469.exe
            "C:\Users\Admin\AppData\Roaming\Download\096469.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:736
            • C:\Users\Admin\AppData\Roaming\Download\096469.exe
              "C:\Users\Admin\AppData\Roaming\Download\096469.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2216
          • C:\Users\Admin\AppData\Roaming\Download\359650.exe
            "C:\Users\Admin\AppData\Roaming\Download\359650.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5476
            • C:\Users\Admin\AppData\Roaming\Download\359650.exe
              "C:\Users\Admin\AppData\Roaming\Download\359650.exe"
              5⤵
                PID:5956
            • C:\Users\Admin\AppData\Roaming\Download\362801.exe
              "C:\Users\Admin\AppData\Roaming\Download\362801.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:3900
              • C:\Users\Admin\AppData\Roaming\Download\362801.exe
                "C:\Users\Admin\AppData\Roaming\Download\362801.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3044
            • C:\Users\Admin\AppData\Roaming\Download\385166.exe
              "C:\Users\Admin\AppData\Roaming\Download\385166.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:1496
              • C:\Users\Admin\AppData\Roaming\Download\385166.exe
                "C:\Users\Admin\AppData\Roaming\Download\385166.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3244
            • C:\Users\Admin\AppData\Roaming\Download\631149.exe
              "C:\Users\Admin\AppData\Roaming\Download\631149.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:656
              • C:\Users\Admin\AppData\Roaming\Download\631149.exe
                "C:\Users\Admin\AppData\Roaming\Download\631149.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5448
            • C:\Users\Admin\AppData\Roaming\Download\275655.exe
              "C:\Users\Admin\AppData\Roaming\Download\275655.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5944
              • C:\Users\Admin\AppData\Roaming\Download\275655.exe
                "C:\Users\Admin\AppData\Roaming\Download\275655.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4648
            • C:\Users\Admin\AppData\Roaming\Download\420537.exe
              "C:\Users\Admin\AppData\Roaming\Download\420537.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5376
              • C:\Users\Admin\AppData\Roaming\Download\420537.exe
                "C:\Users\Admin\AppData\Roaming\Download\420537.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3816
            • C:\Users\Admin\AppData\Roaming\Download\653893.exe
              "C:\Users\Admin\AppData\Roaming\Download\653893.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5492
              • C:\Users\Admin\AppData\Roaming\Download\653893.exe
                "C:\Users\Admin\AppData\Roaming\Download\653893.exe"
                5⤵
                  PID:6100
              • C:\Users\Admin\AppData\Roaming\Download\943518.exe
                "C:\Users\Admin\AppData\Roaming\Download\943518.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:2104
                • C:\Users\Admin\AppData\Roaming\Download\943518.exe
                  "C:\Users\Admin\AppData\Roaming\Download\943518.exe"
                  5⤵
                    PID:4768
                • C:\Users\Admin\AppData\Roaming\Download\924036.exe
                  "C:\Users\Admin\AppData\Roaming\Download\924036.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:412
                  • C:\Users\Admin\AppData\Roaming\Download\924036.exe
                    "C:\Users\Admin\AppData\Roaming\Download\924036.exe"
                    5⤵
                      PID:4988
                  • C:\Users\Admin\AppData\Roaming\Download\008939.exe
                    "C:\Users\Admin\AppData\Roaming\Download\008939.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:5144
                    • C:\Users\Admin\AppData\Roaming\Download\008939.exe
                      "C:\Users\Admin\AppData\Roaming\Download\008939.exe"
                      5⤵
                        PID:5432
                    • C:\Users\Admin\AppData\Roaming\Download\191380.exe
                      "C:\Users\Admin\AppData\Roaming\Download\191380.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:5672
                      • C:\Users\Admin\AppData\Roaming\Download\191380.exe
                        "C:\Users\Admin\AppData\Roaming\Download\191380.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5924
                    • C:\Users\Admin\AppData\Roaming\Download\134446.exe
                      "C:\Users\Admin\AppData\Roaming\Download\134446.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4328
                      • C:\Users\Admin\AppData\Roaming\Download\134446.exe
                        "C:\Users\Admin\AppData\Roaming\Download\134446.exe"
                        5⤵
                          PID:6048
                      • C:\Users\Admin\AppData\Roaming\Download\256702.exe
                        "C:\Users\Admin\AppData\Roaming\Download\256702.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:2216
                        • C:\Users\Admin\AppData\Roaming\Download\256702.exe
                          "C:\Users\Admin\AppData\Roaming\Download\256702.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:3360
                      • C:\Users\Admin\AppData\Roaming\Download\367053.exe
                        "C:\Users\Admin\AppData\Roaming\Download\367053.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:6016
                        • C:\Users\Admin\AppData\Roaming\Download\367053.exe
                          "C:\Users\Admin\AppData\Roaming\Download\367053.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:3312
                      • C:\Users\Admin\AppData\Roaming\Download\421134.exe
                        "C:\Users\Admin\AppData\Roaming\Download\421134.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:5044
                        • C:\Users\Admin\AppData\Roaming\Download\421134.exe
                          "C:\Users\Admin\AppData\Roaming\Download\421134.exe"
                          5⤵
                            PID:2952
                        • C:\Users\Admin\AppData\Roaming\Download\324685.exe
                          "C:\Users\Admin\AppData\Roaming\Download\324685.exe" /Shorttailedrestart
                          4⤵
                            PID:5352
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                        2⤵
                        • Drops file in Program Files directory
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Modifies registry class
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:3936
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x328,0x7fff6766c188,0x7fff6766c194,0x7fff6766c1a0
                          3⤵
                            PID:1204
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,14907644917660726704,12216448106406149269,262144 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
                            3⤵
                              PID:5060
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,7370694366222508791,2185922942378596101,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
                              3⤵
                              • System Time Discovery
                              PID:788
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,5707952869594322079,8306771282079974290,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
                              3⤵
                                PID:2124
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3559849832312192255,811778572144654588,2097152 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
                                3⤵
                                  PID:3244
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,13063405569848976014,9962481174066835670,2097152 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                                  3⤵
                                    PID:2460
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1409297513566292909,8493272084843983897,2097152 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
                                    3⤵
                                      PID:1700
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,2263687697119870456,16826179551276503214,2097152 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
                                      3⤵
                                        PID:2996
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,8665825020235887234,10268009023410710337,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
                                        3⤵
                                          PID:3332
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,14418497429154658738,13639207002206755746,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
                                          3⤵
                                            PID:2952
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,12992607071918015576,17969012830802212157,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
                                            3⤵
                                              PID:2008
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,17907192592409682849,16458337810557385877,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
                                              3⤵
                                                PID:756
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4312387933687859518,17982965561660640930,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
                                                3⤵
                                                  PID:2876
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4312387933687859518,17982965561660640930,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
                                                  3⤵
                                                    PID:4400
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6008,i,10729325061817648440,8645501707936404744,2097152 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
                                                    3⤵
                                                      PID:5128
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,2009801223792922835,3354971960875854049,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
                                                      3⤵
                                                        PID:5668
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,10213492511532463695,4591032321179410404,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
                                                        3⤵
                                                          PID:5860
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,9616613811707854467,8642023428334182184,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
                                                          3⤵
                                                            PID:5984
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,13081417264877843181,4120986376958627331,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
                                                            3⤵
                                                            • Modifies registry class
                                                            PID:5992
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,15081934765823020761,4576193800056680176,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
                                                            3⤵
                                                              PID:5784
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,4561103817903048439,17525723642215901478,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
                                                              3⤵
                                                                PID:1876
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,15141585865965510400,11083489707732795221,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
                                                                3⤵
                                                                  PID:3576
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6600,i,13308960017830709915,5369313811487815352,2097152 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
                                                                  3⤵
                                                                    PID:1892
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,11068478748943466668,4076177488091296399,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
                                                                    3⤵
                                                                      PID:1284
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,13825238642614188499,19862800964030914,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
                                                                      3⤵
                                                                        PID:5144
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15683363529653075998,13759343588504402132,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
                                                                        3⤵
                                                                          PID:5184
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,7614703888620321709,17705634619923029697,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
                                                                          3⤵
                                                                            PID:3892
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4370891382333497080,7064673686990057886,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
                                                                            3⤵
                                                                              PID:3788
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15598366872147564632,3293900257127149819,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
                                                                              3⤵
                                                                                PID:880
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,9696570862835579012,2485466095992259625,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
                                                                                3⤵
                                                                                  PID:3628
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,17219257788785871465,17468084817914409373,262144 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
                                                                                  3⤵
                                                                                    PID:4920
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1160,i,11334641020613771594,9410813836261621984,524288 --field-trial-handle=2288,i,11209123832102622019,4808936661211283064,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
                                                                                    3⤵
                                                                                      PID:6072
                                                                                  • C:\Windows\explorer.exe
                                                                                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                    2⤵
                                                                                      PID:644
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                    1⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1864
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                      2⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:1004
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:2136
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                      1⤵
                                                                                        PID:3244

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            DouTuDaShi.exe
                                                                                            • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                            • Size 1.1MB
                                                                                            • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            nav_config.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3936_1331987486\nav_config.json
                                                                                            • Size 2KB
                                                                                            • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            protocols.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3936_1944560502\protocols.json
                                                                                            • Size 3KB
                                                                                            • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            llm_user_input_extractor_config.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3936_2016396511\llm_user_input_extractor_config.json
                                                                                            • Size 4KB
                                                                                            • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            office_endpoints_list.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3936_2016396511\office_endpoints_list.json
                                                                                            • Size 9KB
                                                                                            • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            smart_switch_list.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3936_2016396511\smart_switch_list.json
                                                                                            • Size 2KB
                                                                                            • SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            79c3e276-4e03-42cb-8596-668520d034de.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\79c3e276-4e03-42cb-8596-668520d034de.tmp
                                                                                            • Size 18KB
                                                                                            • SHA256 fc409dd0fa6e11d403e25e3c87f41b79d2df553af473c1dbccc4060d85366b37
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                            • Size 135B
                                                                                            • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            6547d984-c304-4938-8b46-15339a1de3d0.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6547d984-c304-4938-8b46-15339a1de3d0.tmp
                                                                                            • Size 10KB
                                                                                            • SHA256 a33f0beb9d892ed36e85c03881091f7f4201d42def7cf4b9be0ce9a1d55a8c26
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            895b542e-7b6f-4c52-af2e-6b102d4ced47.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\895b542e-7b6f-4c52-af2e-6b102d4ced47.tmp
                                                                                            • Size 27KB
                                                                                            • SHA256 41a65be4434dca04c63dde936564e907e9136c7abbc06e1b541d1611bd208ea0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            f_000050
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
                                                                                            • Size 61KB
                                                                                            • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            temp-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                            • Size 3KB
                                                                                            • SHA256 146986c617f924449ab38b765302a9dbb464b00571694ea31aae431484692b08
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 2KB
                                                                                            • SHA256 a2ddd89b2186349c4b188461c79304bfe74174eed271081bdb7de8bd04c46b59
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            c4dc8255-b9c2-4b1c-bda0-bca5508f08d2.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c4dc8255-b9c2-4b1c-bda0-bca5508f08d2.tmp
                                                                                            • Size 2B
                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            dasherSettingSchema.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
                                                                                            • Size 854B
                                                                                            • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            30c44f54-6067-4e9b-9c79-0ba312c51489.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\30c44f54-6067-4e9b-9c79-0ba312c51489.tmp
                                                                                            • Size 2B
                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            3213c74e-2fff-46ba-92b3-6f7580831741.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3213c74e-2fff-46ba-92b3-6f7580831741.tmp
                                                                                            • Size 6KB
                                                                                            • SHA256 94d0d66ab071192bf0b83041715fae821a75e28bfb6c94c32b10514f2f03d6ae
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            71487af0-f963-45cd-b7a8-f46333bc25a1.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\71487af0-f963-45cd-b7a8-f46333bc25a1.tmp
                                                                                            • Size 111B
                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            b61b3279-9e75-43c7-ad54-19c637aaa861.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b61b3279-9e75-43c7-ad54-19c637aaa861.tmp
                                                                                            • Size 70KB
                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            bfcd0e0b-a82f-46ce-97a2-36fc5bee8462.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bfcd0e0b-a82f-46ce-97a2-36fc5bee8462.tmp
                                                                                            • Size 11KB
                                                                                            • SHA256 4cd0a7c05bbe952d06a5639590a580d9337a05ab8b8403f9e61abb5110d577e6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c5879f19-0420-468e-b83a-d06a118debf8.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5879f19-0420-468e-b83a-d06a118debf8.tmp
                                                                                            • Size 11KB
                                                                                            • SHA256 a2a53c6119ec5049912b012d5fe89d9ac0e5795ce0bfaa1ed1a1865fae4b3577
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            OperationConfig
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                            • Size 3KB
                                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ffac1595-2a7a-4207-acb4-b356de93d82b.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ffac1595-2a7a-4207-acb4-b356de93d82b.tmp
                                                                                            • Size 22KB
                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
                                                                                            • Size 165B
                                                                                            • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            • Size 8KB
                                                                                            • SHA256 394308464b63d98956d08b66d13cbf0afc3a930272b43d6a9312ab2fa2ab904a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                            • Size 43B
                                                                                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                            • Size 160B
                                                                                            • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ca89db1a-b6e9-4f7b-9df4-bd0b6cf0efd3.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca89db1a-b6e9-4f7b-9df4-bd0b6cf0efd3.tmp
                                                                                            • Size 23KB
                                                                                            • SHA256 d0fadbc911debe5f05c75cfb0dd38d7ebf6963e5433955eedb383027df989c39
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            3df35a8e-d9ac-4aa4-9d81-c24743c98f5a.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3df35a8e-d9ac-4aa4-9d81-c24743c98f5a.tmp
                                                                                            • Size 372B
                                                                                            • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            4d230c3e-969c-4fc0-a054-fa85e9717215.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4d230c3e-969c-4fc0-a054-fa85e9717215.tmp
                                                                                            • Size 132B
                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            8b7a623b-013f-4a8d-a5f9-39fb42f1fca2.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8b7a623b-013f-4a8d-a5f9-39fb42f1fca2.tmp
                                                                                            • Size 252B
                                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ea5288ff-9eca-435c-a998-17bb066ebf4a.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea5288ff-9eca-435c-a998-17bb066ebf4a.tmp
                                                                                            • Size 8KB
                                                                                            • SHA256 5dec86b05846290c49359e8a58f3e3014ef62fcfb079450349cc01c715935a55
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ebaf46b0-3d84-40cf-a3f6-f1a2983ac92c.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebaf46b0-3d84-40cf-a3f6-f1a2983ac92c.tmp
                                                                                            • Size 18KB
                                                                                            • SHA256 884d6bc68dbacb08721f2c60d8170dbf25f02dfe2f19a489a893206d4b326634
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            541c2e37-b575-4eb2-8375-4b39a9749072.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\541c2e37-b575-4eb2-8375-4b39a9749072.tmp
                                                                                            • Size 13B
                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BZK8N9PN\hao.360[1].xml
                                                                                            • Size 1KB
                                                                                            • SHA256 a3d6cde21327e45c545ca54720aa7af1721ca0ca8b3ef02098772fa1f81eedfc
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BZK8N9PN\hao.360[1].xml
                                                                                            • Size 5KB
                                                                                            • SHA256 74732116d71f34b69c40afc3ee90cfb46ff02d3748a988582cf3793012f17dd1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                            • Size 2KB
                                                                                            • SHA256 3366a55ed78575f0fbdfece37a0c51e489fe2471b7f43272237acdfb3af85321
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            time[1].js
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7R3PVEMI\time[1].js
                                                                                            • Size 27B
                                                                                            • SHA256 d239c75ad71962c0cabaffbf8e70c6df6ce5efc886f2ff4776c28d02ed9af3bc
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            QHCmHelp1.0.0.1[1].cab
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VIJY9X14\QHCmHelp1.0.0.1[1].cab
                                                                                            • Size 199KB
                                                                                            • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            behavior[2].htm
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VIJY9X14\behavior[2].htm
                                                                                            • Size 43B
                                                                                            • SHA256 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            125d720c-a3e1-4032-a16f-11bea9ddfa50.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\125d720c-a3e1-4032-a16f-11bea9ddfa50.tmp
                                                                                            • Size 157KB
                                                                                            • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            b6ddc4f1-c04e-4e14-a0f7-1a057b3ca43c.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\b6ddc4f1-c04e-4e14-a0f7-1a057b3ca43c.tmp
                                                                                            • Size 1B
                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            ldsajdklsajdlkjsalkda.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                            • Size 589B
                                                                                            • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            messages.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3936_1185273871\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                            • Size 711B
                                                                                            • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            3de5ee67-2ee4-4715-a35a-c3d376fb72c4.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3936_701346\3de5ee67-2ee4-4715-a35a-c3d376fb72c4.tmp
                                                                                            • Size 10KB
                                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            content.js
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3936_701346\CRX_INSTALL\content.js
                                                                                            • Size 9KB
                                                                                            • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            snewhx.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\snewhx.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 05d6c859953127e19b3f3c9d964952ed3bcc75f6a962d3e21dc5f45f9b65aa63
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            016871.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\016871.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 213489dd56d6b68da274c6aa303747667298a356a3fdbfcd42d6d281c150528c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            094159.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\094159.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 a6b7a9b5cba0b23bcefdca891f3cb5bc80b4718b67fcdaa21ab7bfbe3567d61a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            109246.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\109246.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 71b522c2d749a62c61d7a1a8ec4f16cad5695500c6373a6d5158c9a80bac3094
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            112720.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\112720.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 dccbffff7f2385059490df07ebafad06ea8d2c68f37e2575a9f1fc96cb865b3c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            203869.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\203869.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 8aeae2a9ba3a4f7f3439e74d8eeddd675e3777a3cce1c736119cafd222b32e60
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            217290.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\217290.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 f886f43fcade6921c8df1d3e442b1a43c15e3023f6312704dbfef2588f9dcb88
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            225209.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\225209.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 987e3fd17ff5631bae7d34331467b8ae3d6eda6cc79134d6a0e160de0a35ad85
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            236417.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\236417.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 0fd2aa07cd620d46ab2566515f619362804eda91d261b6668fb8caa6018e65fc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            345233.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\345233.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 e7e3a58b72777282b908313b9d00e712fb528b8150b7eac5cb7e6e5a4dae17fd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            482539.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\482539.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 c8c691f6fb5c228259b8ce1ff580119327baeec523a164ac888d4ca1dc15578b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            825913.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\825913.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 0d47abc2d24b7570506e52b39e9a8646a470103669ed04acf9fb4ea197ac472a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            919721.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\919721.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 725bf4adb1ddcf793a418d14fb0d5f0ab5cd42558b906fcbbb49f4e803f1287a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            memory/2360-369-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/2360-1079-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/2360-995-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/3812-189-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download