Overview

overview

7

Static

static

3

2026-10-19...op.exe

windows10-2004-x64

7

2026-10-19...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/10/2026, 23:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-19_373ac79b173546727a457e7ed8b18f0a_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261020-3fg7asxtgx
  • SHA256 4ba5b12358bd799e46edbe687f1cc1f733a96f227d097942a5a29e8b6018814e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 14 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-19_373ac79b173546727a457e7ed8b18f0a_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-19_373ac79b173546727a457e7ed8b18f0a_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:1960
    • C:\Users\Admin\AppData\Local\Temp\qpxuwx.exe
      "C:\Users\Admin\AppData\Local\Temp\qpxuwx.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Users\Admin\AppData\Local\Temp\qpxuwx.exe
        "C:\Users\Admin\AppData\Local\Temp\qpxuwx.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Users\Admin\AppData\Roaming\Download\557753.exe
          "C:\Users\Admin\AppData\Roaming\Download\557753.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Users\Admin\AppData\Roaming\Download\557753.exe
            "C:\Users\Admin\AppData\Roaming\Download\557753.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3412
        • C:\Users\Admin\AppData\Roaming\Download\329611.exe
          "C:\Users\Admin\AppData\Roaming\Download\329611.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:952
          • C:\Users\Admin\AppData\Roaming\Download\329611.exe
            "C:\Users\Admin\AppData\Roaming\Download\329611.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2300
        • C:\Users\Admin\AppData\Roaming\Download\451997.exe
          "C:\Users\Admin\AppData\Roaming\Download\451997.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Users\Admin\AppData\Roaming\Download\451997.exe
            "C:\Users\Admin\AppData\Roaming\Download\451997.exe"
            5⤵
            • Executes dropped EXE
            PID:4676
        • C:\Users\Admin\AppData\Roaming\Download\800774.exe
          "C:\Users\Admin\AppData\Roaming\Download\800774.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2148
          • C:\Users\Admin\AppData\Roaming\Download\800774.exe
            "C:\Users\Admin\AppData\Roaming\Download\800774.exe"
            5⤵
            • Executes dropped EXE
            PID:5176
        • C:\Users\Admin\AppData\Roaming\Download\198561.exe
          "C:\Users\Admin\AppData\Roaming\Download\198561.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5572
          • C:\Users\Admin\AppData\Roaming\Download\198561.exe
            "C:\Users\Admin\AppData\Roaming\Download\198561.exe"
            5⤵
            • Executes dropped EXE
            PID:5792
        • C:\Users\Admin\AppData\Roaming\Download\182739.exe
          "C:\Users\Admin\AppData\Roaming\Download\182739.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6096
          • C:\Users\Admin\AppData\Roaming\Download\182739.exe
            "C:\Users\Admin\AppData\Roaming\Download\182739.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5368
        • C:\Users\Admin\AppData\Roaming\Download\324095.exe
          "C:\Users\Admin\AppData\Roaming\Download\324095.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5524
          • C:\Users\Admin\AppData\Roaming\Download\324095.exe
            "C:\Users\Admin\AppData\Roaming\Download\324095.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4084
        • C:\Users\Admin\AppData\Roaming\Download\608049.exe
          "C:\Users\Admin\AppData\Roaming\Download\608049.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5992
          • C:\Users\Admin\AppData\Roaming\Download\608049.exe
            "C:\Users\Admin\AppData\Roaming\Download\608049.exe"
            5⤵
            • Executes dropped EXE
            PID:3736
        • C:\Users\Admin\AppData\Roaming\Download\844021.exe
          "C:\Users\Admin\AppData\Roaming\Download\844021.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5704
          • C:\Users\Admin\AppData\Roaming\Download\844021.exe
            "C:\Users\Admin\AppData\Roaming\Download\844021.exe"
            5⤵
            • Executes dropped EXE
            PID:5436
        • C:\Users\Admin\AppData\Roaming\Download\211819.exe
          "C:\Users\Admin\AppData\Roaming\Download\211819.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4252
          • C:\Users\Admin\AppData\Roaming\Download\211819.exe
            "C:\Users\Admin\AppData\Roaming\Download\211819.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5748
        • C:\Users\Admin\AppData\Roaming\Download\979538.exe
          "C:\Users\Admin\AppData\Roaming\Download\979538.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5848
          • C:\Users\Admin\AppData\Roaming\Download\979538.exe
            "C:\Users\Admin\AppData\Roaming\Download\979538.exe"
            5⤵
            • Executes dropped EXE
            PID:4780
        • C:\Users\Admin\AppData\Roaming\Download\247326.exe
          "C:\Users\Admin\AppData\Roaming\Download\247326.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5972
          • C:\Users\Admin\AppData\Roaming\Download\247326.exe
            "C:\Users\Admin\AppData\Roaming\Download\247326.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6124
        • C:\Users\Admin\AppData\Roaming\Download\244950.exe
          "C:\Users\Admin\AppData\Roaming\Download\244950.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4308
          • C:\Users\Admin\AppData\Roaming\Download\244950.exe
            "C:\Users\Admin\AppData\Roaming\Download\244950.exe"
            5⤵
            • Executes dropped EXE
            PID:5264
        • C:\Users\Admin\AppData\Roaming\Download\267238.exe
          "C:\Users\Admin\AppData\Roaming\Download\267238.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5028
          • C:\Users\Admin\AppData\Roaming\Download\267238.exe
            "C:\Users\Admin\AppData\Roaming\Download\267238.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1604
        • C:\Users\Admin\AppData\Roaming\Download\289304.exe
          "C:\Users\Admin\AppData\Roaming\Download\289304.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1992
          • C:\Users\Admin\AppData\Roaming\Download\289304.exe
            "C:\Users\Admin\AppData\Roaming\Download\289304.exe"
            5⤵
            • Executes dropped EXE
            PID:1824
        • C:\Users\Admin\AppData\Roaming\Download\222660.exe
          "C:\Users\Admin\AppData\Roaming\Download\222660.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4484
          • C:\Users\Admin\AppData\Roaming\Download\222660.exe
            "C:\Users\Admin\AppData\Roaming\Download\222660.exe"
            5⤵
            • Executes dropped EXE
            PID:2576
        • C:\Users\Admin\AppData\Roaming\Download\554926.exe
          "C:\Users\Admin\AppData\Roaming\Download\554926.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5888
          • C:\Users\Admin\AppData\Roaming\Download\554926.exe
            "C:\Users\Admin\AppData\Roaming\Download\554926.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1256
        • C:\Users\Admin\AppData\Roaming\Download\457276.exe
          "C:\Users\Admin\AppData\Roaming\Download\457276.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6112
          • C:\Users\Admin\AppData\Roaming\Download\457276.exe
            "C:\Users\Admin\AppData\Roaming\Download\457276.exe"
            5⤵
            • Executes dropped EXE
            PID:5444
        • C:\Users\Admin\AppData\Roaming\Download\479532.exe
          "C:\Users\Admin\AppData\Roaming\Download\479532.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5452
          • C:\Users\Admin\AppData\Roaming\Download\479532.exe
            "C:\Users\Admin\AppData\Roaming\Download\479532.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4960
        • C:\Users\Admin\AppData\Roaming\Download\867330.exe
          "C:\Users\Admin\AppData\Roaming\Download\867330.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5244
          • C:\Users\Admin\AppData\Roaming\Download\867330.exe
            "C:\Users\Admin\AppData\Roaming\Download\867330.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4128
        • C:\Users\Admin\AppData\Roaming\Download\503049.exe
          "C:\Users\Admin\AppData\Roaming\Download\503049.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2012
          • C:\Users\Admin\AppData\Roaming\Download\503049.exe
            "C:\Users\Admin\AppData\Roaming\Download\503049.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2220
        • C:\Users\Admin\AppData\Roaming\Download\647115.exe
          "C:\Users\Admin\AppData\Roaming\Download\647115.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5640
          • C:\Users\Admin\AppData\Roaming\Download\647115.exe
            "C:\Users\Admin\AppData\Roaming\Download\647115.exe"
            5⤵
            • Executes dropped EXE
            PID:1420
        • C:\Users\Admin\AppData\Roaming\Download\860471.exe
          "C:\Users\Admin\AppData\Roaming\Download\860471.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4444
          • C:\Users\Admin\AppData\Roaming\Download\860471.exe
            "C:\Users\Admin\AppData\Roaming\Download\860471.exe"
            5⤵
            • Executes dropped EXE
            PID:2448
        • C:\Users\Admin\AppData\Roaming\Download\892737.exe
          "C:\Users\Admin\AppData\Roaming\Download\892737.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:716
          • C:\Users\Admin\AppData\Roaming\Download\892737.exe
            "C:\Users\Admin\AppData\Roaming\Download\892737.exe"
            5⤵
            • Executes dropped EXE
            PID:4000
        • C:\Users\Admin\AppData\Roaming\Download\835895.exe
          "C:\Users\Admin\AppData\Roaming\Download\835895.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5836
          • C:\Users\Admin\AppData\Roaming\Download\835895.exe
            "C:\Users\Admin\AppData\Roaming\Download\835895.exe"
            5⤵
            • Executes dropped EXE
            PID:1512
        • C:\Users\Admin\AppData\Roaming\Download\157161.exe
          "C:\Users\Admin\AppData\Roaming\Download\157161.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5252
          • C:\Users\Admin\AppData\Roaming\Download\157161.exe
            "C:\Users\Admin\AppData\Roaming\Download\157161.exe"
            5⤵
            • Executes dropped EXE
            PID:3344
        • C:\Users\Admin\AppData\Roaming\Download\068412.exe
          "C:\Users\Admin\AppData\Roaming\Download\068412.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5208
          • C:\Users\Admin\AppData\Roaming\Download\068412.exe
            "C:\Users\Admin\AppData\Roaming\Download\068412.exe"
            5⤵
            • Executes dropped EXE
            PID:4256
        • C:\Users\Admin\AppData\Roaming\Download\359124.exe
          "C:\Users\Admin\AppData\Roaming\Download\359124.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5644
          • C:\Users\Admin\AppData\Roaming\Download\359124.exe
            "C:\Users\Admin\AppData\Roaming\Download\359124.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5548
        • C:\Users\Admin\AppData\Roaming\Download\626014.exe
          "C:\Users\Admin\AppData\Roaming\Download\626014.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2556
          • C:\Users\Admin\AppData\Roaming\Download\626014.exe
            "C:\Users\Admin\AppData\Roaming\Download\626014.exe"
            5⤵
            • Executes dropped EXE
            PID:3420
        • C:\Users\Admin\AppData\Roaming\Download\564833.exe
          "C:\Users\Admin\AppData\Roaming\Download\564833.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5856
          • C:\Users\Admin\AppData\Roaming\Download\564833.exe
            "C:\Users\Admin\AppData\Roaming\Download\564833.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4780
        • C:\Users\Admin\AppData\Roaming\Download\749620.exe
          "C:\Users\Admin\AppData\Roaming\Download\749620.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:836
          • C:\Users\Admin\AppData\Roaming\Download\749620.exe
            "C:\Users\Admin\AppData\Roaming\Download\749620.exe"
            5⤵
              PID:5996
          • C:\Users\Admin\AppData\Roaming\Download\894996.exe
            "C:\Users\Admin\AppData\Roaming\Download\894996.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:2320
            • C:\Users\Admin\AppData\Roaming\Download\894996.exe
              "C:\Users\Admin\AppData\Roaming\Download\894996.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5752
          • C:\Users\Admin\AppData\Roaming\Download\862340.exe
            "C:\Users\Admin\AppData\Roaming\Download\862340.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:2228
            • C:\Users\Admin\AppData\Roaming\Download\862340.exe
              "C:\Users\Admin\AppData\Roaming\Download\862340.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2548
          • C:\Users\Admin\AppData\Roaming\Download\917503.exe
            "C:\Users\Admin\AppData\Roaming\Download\917503.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:4404
            • C:\Users\Admin\AppData\Roaming\Download\917503.exe
              "C:\Users\Admin\AppData\Roaming\Download\917503.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4536
          • C:\Users\Admin\AppData\Roaming\Download\930689.exe
            "C:\Users\Admin\AppData\Roaming\Download\930689.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:3776
            • C:\Users\Admin\AppData\Roaming\Download\930689.exe
              "C:\Users\Admin\AppData\Roaming\Download\930689.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2220
          • C:\Users\Admin\AppData\Roaming\Download\162945.exe
            "C:\Users\Admin\AppData\Roaming\Download\162945.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:2376
            • C:\Users\Admin\AppData\Roaming\Download\162945.exe
              "C:\Users\Admin\AppData\Roaming\Download\162945.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4612
          • C:\Users\Admin\AppData\Roaming\Download\687516.exe
            "C:\Users\Admin\AppData\Roaming\Download\687516.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:4024
            • C:\Users\Admin\AppData\Roaming\Download\687516.exe
              "C:\Users\Admin\AppData\Roaming\Download\687516.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5092
          • C:\Users\Admin\AppData\Roaming\Download\127045.exe
            "C:\Users\Admin\AppData\Roaming\Download\127045.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5804
            • C:\Users\Admin\AppData\Roaming\Download\127045.exe
              "C:\Users\Admin\AppData\Roaming\Download\127045.exe"
              5⤵
                PID:4764
            • C:\Users\Admin\AppData\Roaming\Download\452027.exe
              "C:\Users\Admin\AppData\Roaming\Download\452027.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:3028
              • C:\Users\Admin\AppData\Roaming\Download\452027.exe
                "C:\Users\Admin\AppData\Roaming\Download\452027.exe"
                5⤵
                  PID:4948
              • C:\Users\Admin\AppData\Roaming\Download\455478.exe
                "C:\Users\Admin\AppData\Roaming\Download\455478.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:2820
                • C:\Users\Admin\AppData\Roaming\Download\455478.exe
                  "C:\Users\Admin\AppData\Roaming\Download\455478.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:640
              • C:\Users\Admin\AppData\Roaming\Download\478534.exe
                "C:\Users\Admin\AppData\Roaming\Download\478534.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3980
                • C:\Users\Admin\AppData\Roaming\Download\478534.exe
                  "C:\Users\Admin\AppData\Roaming\Download\478534.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2252
              • C:\Users\Admin\AppData\Roaming\Download\456169.exe
                "C:\Users\Admin\AppData\Roaming\Download\456169.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:2076
                • C:\Users\Admin\AppData\Roaming\Download\456169.exe
                  "C:\Users\Admin\AppData\Roaming\Download\456169.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1924
              • C:\Users\Admin\AppData\Roaming\Download\498454.exe
                "C:\Users\Admin\AppData\Roaming\Download\498454.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:8
                • C:\Users\Admin\AppData\Roaming\Download\498454.exe
                  "C:\Users\Admin\AppData\Roaming\Download\498454.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:5692
              • C:\Users\Admin\AppData\Roaming\Download\422510.exe
                "C:\Users\Admin\AppData\Roaming\Download\422510.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:3712
                • C:\Users\Admin\AppData\Roaming\Download\422510.exe
                  "C:\Users\Admin\AppData\Roaming\Download\422510.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:5616
              • C:\Users\Admin\AppData\Roaming\Download\465876.exe
                "C:\Users\Admin\AppData\Roaming\Download\465876.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:2592
                • C:\Users\Admin\AppData\Roaming\Download\465876.exe
                  "C:\Users\Admin\AppData\Roaming\Download\465876.exe"
                  5⤵
                    PID:3956
                • C:\Users\Admin\AppData\Roaming\Download\787132.exe
                  "C:\Users\Admin\AppData\Roaming\Download\787132.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  PID:5948
                  • C:\Users\Admin\AppData\Roaming\Download\787132.exe
                    "C:\Users\Admin\AppData\Roaming\Download\787132.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4348
                • C:\Users\Admin\AppData\Roaming\Download\720200.exe
                  "C:\Users\Admin\AppData\Roaming\Download\720200.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  PID:5768
                  • C:\Users\Admin\AppData\Roaming\Download\720200.exe
                    "C:\Users\Admin\AppData\Roaming\Download\720200.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5996
                • C:\Users\Admin\AppData\Roaming\Download\856281.exe
                  "C:\Users\Admin\AppData\Roaming\Download\856281.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5444
                  • C:\Users\Admin\AppData\Roaming\Download\856281.exe
                    "C:\Users\Admin\AppData\Roaming\Download\856281.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4228
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
              2⤵
              • Drops file in Program Files directory
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3880
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fff6637c188,0x7fff6637c194,0x7fff6637c1a0
                3⤵
                  PID:1144
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17663044751174119045,10871181834439313234,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
                  3⤵
                  • System Time Discovery
                  PID:1876
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,783794385607555549,16305485783763360940,262144 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
                  3⤵
                    PID:1164
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,4226634695552219769,17568013081979821208,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
                    3⤵
                      PID:3288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,9302924748588995167,3951978117282331299,2097152 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
                      3⤵
                        PID:1032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,263131759221878192,3017239498781334631,2097152 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                        3⤵
                          PID:432
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,13286532493668343045,883397675925307074,2097152 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
                          3⤵
                            PID:3500
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,3917660779439042625,5423139831530426340,2097152 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
                            3⤵
                              PID:2676
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9724106380134285276,12325765793704113514,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
                              3⤵
                                PID:3736
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,16094077935790895462,4919218205763005904,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
                                3⤵
                                  PID:752
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5088,i,8547224872699776687,8974227258337157322,2097152 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
                                  3⤵
                                    PID:4812
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4497996268175862719,616242764565539676,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
                                    3⤵
                                      PID:3900
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,3983623434526476042,2494798227697629640,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
                                      3⤵
                                        PID:3536
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,5018578300896479527,18431240230080115061,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
                                        3⤵
                                          PID:5724
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,5018578300896479527,18431240230080115061,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
                                          3⤵
                                            PID:5752
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4035463552936352727,11528115279288489833,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
                                            3⤵
                                              PID:6080
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13181520649947839674,12127787691340920255,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
                                              3⤵
                                                PID:5240
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3802592188390312009,3367863505919378765,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
                                                3⤵
                                                  PID:5644
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,16480363792150374617,5599349715141008075,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
                                                  3⤵
                                                  • Modifies registry class
                                                  PID:1236
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17676975824455858344,9044623831507448411,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
                                                  3⤵
                                                    PID:5144
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,8481557393702613235,16421037110262305493,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
                                                    3⤵
                                                      PID:5416
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,1157215923504039837,16323812944433594519,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
                                                      3⤵
                                                        PID:3700
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6860,i,11353307538838219178,8599861173469687166,2097152 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
                                                        3⤵
                                                          PID:6000
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,13933198268189731278,11777173465525834009,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
                                                          3⤵
                                                            PID:5440
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,2458776111370260941,3815464740823393293,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
                                                            3⤵
                                                              PID:1652
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6644663548127444226,4906316092413327137,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
                                                              3⤵
                                                                PID:4644
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,12961688135415034960,14266517844426665958,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
                                                                3⤵
                                                                  PID:3916
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,10416809925330523496,10582321052853397112,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
                                                                  3⤵
                                                                    PID:5784
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10587285590135607346,523809305269638413,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
                                                                    3⤵
                                                                      PID:728
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,15164062698263845644,1751209930283293074,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
                                                                      3⤵
                                                                        PID:2900
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5248499163021937195,7069444692786386945,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
                                                                        3⤵
                                                                          PID:3836
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,14944863787450428410,14909187045222442856,262144 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
                                                                          3⤵
                                                                            PID:2128
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,17334059842096569972,9523193571110952297,524288 --field-trial-handle=2388,i,4071226770915696062,257052094695236076,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
                                                                            3⤵
                                                                              PID:5320
                                                                          • C:\Windows\explorer.exe
                                                                            "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                            2⤵
                                                                              PID:4788
                                                                          • C:\Windows\explorer.exe
                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                            1⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1172
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                              2⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:1532
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                            1⤵
                                                                              PID:3776

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  DouTuDaShi.exe
                                                                                  • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                  • Size 1.1MB
                                                                                  • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  LICENSE
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_1115672795\LICENSE
                                                                                  • Size 1KB
                                                                                  • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  verified_contents.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_1115672795\_metadata\verified_contents.json
                                                                                  • Size 1KB
                                                                                  • SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  keys.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_1115672795\keys.json
                                                                                  • Size 3KB
                                                                                  • SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  protocols.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_118521938\protocols.json
                                                                                  • Size 3KB
                                                                                  • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  nav_config.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_1571075327\nav_config.json
                                                                                  • Size 2KB
                                                                                  • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  llm_user_input_extractor_config.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_2089708824\llm_user_input_extractor_config.json
                                                                                  • Size 4KB
                                                                                  • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  office_endpoints_list.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_2089708824\office_endpoints_list.json
                                                                                  • Size 9KB
                                                                                  • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  smart_switch_list.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3880_2089708824\smart_switch_list.json
                                                                                  • Size 2KB
                                                                                  • SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  0302a513-b898-46af-8ceb-29bb1849af91.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0302a513-b898-46af-8ceb-29bb1849af91.tmp
                                                                                  • Size 8KB
                                                                                  • SHA256 a7dc6bb8d57378f291e1f972a4b32dfecf572869a449a21f6468c927c1e7d797
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  557bb9fb-bad0-481a-ae04-1258cd2d083c.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\557bb9fb-bad0-481a-ae04-1258cd2d083c.tmp
                                                                                  • Size 18KB
                                                                                  • SHA256 1d69a3bf5bfb4eee72d422110d7861e650974f4d7ce5730ed1e840987bd4f369
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  8bb9b99b-bbf8-4830-97ce-5ddcc6ff01e2.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8bb9b99b-bbf8-4830-97ce-5ddcc6ff01e2.tmp
                                                                                  • Size 18KB
                                                                                  • SHA256 2f37b90164375a5d8b7aa37bff84122c2a5dcbca83b6296bd1e343d76e6f6edf
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  41062e02-844a-40ee-9b25-9045513483b3.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\41062e02-844a-40ee-9b25-9045513483b3.tmp
                                                                                  • Size 105KB
                                                                                  • SHA256 3c023366c78522106a9da07039c85fdca442b8b2524e3ef09015959fba816460
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                  • Size 135B
                                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  68833738-82f9-44de-9ce7-2f43869a8cdc.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68833738-82f9-44de-9ce7-2f43869a8cdc.tmp
                                                                                  • Size 11KB
                                                                                  • SHA256 d4d64db13acd6ed7967bcc1f11d29bffaaa68ef80937085fb810a98e4398fa0a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  73bf3747-4d82-4c76-b97a-df5baeaf9119.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73bf3747-4d82-4c76-b97a-df5baeaf9119.tmp
                                                                                  • Size 11KB
                                                                                  • SHA256 5d7959b4d69581aefcbe558ac4af5c06eb0cd7cae09e3f554e11e7c8aa2dc70e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  f_00004e
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
                                                                                  • Size 61KB
                                                                                  • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  temp-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                  • Size 3KB
                                                                                  • SHA256 e6cbd9afd395ccdd4e0cf1486004dda8046bbd5a19d53124a71b9a2691dd7eaf
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 2KB
                                                                                  • SHA256 156e74929caba39eab702e4881caedf6e41991cd7c8543b58dde21dd3fa32b5d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  8296a379-9376-400c-82de-ca6744b1e8d1.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8296a379-9376-400c-82de-ca6744b1e8d1.tmp
                                                                                  • Size 2B
                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  dasherSettingSchema.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                  • Size 854B
                                                                                  • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  5bf10bfd-43bc-43fd-b5ba-d20ec0352c20.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5bf10bfd-43bc-43fd-b5ba-d20ec0352c20.tmp
                                                                                  • Size 2B
                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  cb0f0de2-fff1-43b7-b342-fdb4993837ae.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb0f0de2-fff1-43b7-b342-fdb4993837ae.tmp
                                                                                  • Size 5KB
                                                                                  • SHA256 16a7383b131e6e0bc429dfa82f1248678c0e5334e47518d9b4554aaa597e76ce
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  e2cd3dcb-7bc5-4828-93a8-ff5e04ac3c64.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2cd3dcb-7bc5-4828-93a8-ff5e04ac3c64.tmp
                                                                                  • Size 111B
                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  sync_diagnostic.log
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                  • Size 4KB
                                                                                  • SHA256 3d7cdcde3a26a3f9fcc47be3f2919474c08bc98015b3b3b2fccd4934812b0370
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  b7dcb3e3-2f31-4c90-b47e-98bf4565a870.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7dcb3e3-2f31-4c90-b47e-98bf4565a870.tmp
                                                                                  • Size 11KB
                                                                                  • SHA256 06d92960b918513dedd0d4571f2f4e51ac8615a637eb2a3d6b877199e1d30c20
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  bb5311d5-1bee-419a-8633-74c48bb7ab08.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb5311d5-1bee-419a-8633-74c48bb7ab08.tmp
                                                                                  • Size 70KB
                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  c1af158b-9a69-4bd0-9088-7542ed339929.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1af158b-9a69-4bd0-9088-7542ed339929.tmp
                                                                                  • Size 6B
                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  f189afd3-0327-4702-9715-6ee6b4a7d748.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f189afd3-0327-4702-9715-6ee6b4a7d748.tmp
                                                                                  • Size 32KB
                                                                                  • SHA256 32da278b34501d80270c04e7825e0ee437e2ec264c2e3924661bed8f8f3da15c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  0659e1f2-114b-4836-a2c3-31edf14c9758.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0659e1f2-114b-4836-a2c3-31edf14c9758.tmp
                                                                                  • Size 22KB
                                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  OperationConfig
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                  • Size 3KB
                                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
                                                                                  • Size 165B
                                                                                  • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                  • Size 43B
                                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
                                                                                  • Size 80B
                                                                                  • SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                  • Size 160B
                                                                                  • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  b14122ff-5681-4f57-8f5a-ec8485aa456b.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b14122ff-5681-4f57-8f5a-ec8485aa456b.tmp
                                                                                  • Size 28KB
                                                                                  • SHA256 7c477263abb521cbb66c074dc70a22cd323848fd2935317290a8b1492fd73d99
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  b9a5cb67-63c0-4121-9262-f575398119ed.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9a5cb67-63c0-4121-9262-f575398119ed.tmp
                                                                                  • Size 8KB
                                                                                  • SHA256 90857a2eadde4548590229066f71c73b51fdb0390133269e2e88923c77f8655f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  3a41c911-e558-4e7b-b637-1f09740a27a9.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3a41c911-e558-4e7b-b637-1f09740a27a9.tmp
                                                                                  • Size 372B
                                                                                  • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  6377ae58-fbd0-4968-8330-6baa15242329.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6377ae58-fbd0-4968-8330-6baa15242329.tmp
                                                                                  • Size 252B
                                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  6bdb452c-271b-483d-a0af-48b9dd9afb45.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6bdb452c-271b-483d-a0af-48b9dd9afb45.tmp
                                                                                  • Size 132B
                                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  994feed4-2588-4bc1-883e-b2b604a940be.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\994feed4-2588-4bc1-883e-b2b604a940be.tmp
                                                                                  • Size 492B
                                                                                  • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  08119dba-9108-4869-a1b6-1a27aed3d947.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08119dba-9108-4869-a1b6-1a27aed3d947.tmp
                                                                                  • Size 13B
                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  hao.360[1].xml
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZQASHAFP\hao.360[1].xml
                                                                                  • Size 54KB
                                                                                  • SHA256 6e1128a06eb1de55490cdbfa7c9217dfb298ed5c4736e2600bd0d5f3d354129b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  hao.360[1].xml
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZQASHAFP\hao.360[1].xml
                                                                                  • Size 50KB
                                                                                  • SHA256 6152b5b7a75d813eb4f61fc4964bd3aa918623687ce4b9d3519dcf4bad3e3568
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                  • Size 2KB
                                                                                  • SHA256 0e73a63c2b4ab3ca08418bafc95da5ff1c3352fa7f7fa7f31af6f7deca9ec9d8
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  QHCmHelp1.0.0.1[1].cab
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LBHX3A6T\QHCmHelp1.0.0.1[1].cab
                                                                                  • Size 199KB
                                                                                  • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  time[1].js
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LBHX3A6T\time[1].js
                                                                                  • Size 27B
                                                                                  • SHA256 4a2b0bcface04c31afb0118e6e52c65042998d1d06baa9ca2f36f21a91283505
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  behavior[2].htm
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QXG0Z7Y9\behavior[2].htm
                                                                                  • Size 43B
                                                                                  • SHA256 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  sed_api_weather_info[1].htm
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QXG0Z7Y9\sed_api_weather_info[1].htm
                                                                                  • Size 8KB
                                                                                  • SHA256 ed6ae61cf620f9728ab549f9edb8d3ee3ab735a201488f0ddcd5bfa9870f5aef
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  0[1].png
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RNU3R319\0[1].png
                                                                                  • Size 574B
                                                                                  • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  42a65eef-b4eb-43ba-b26c-0f59801d826e.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\42a65eef-b4eb-43ba-b26c-0f59801d826e.tmp
                                                                                  • Size 1B
                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  f34257a5-50b9-4c6d-9e59-41e15efdf6d6.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\f34257a5-50b9-4c6d-9e59-41e15efdf6d6.tmp
                                                                                  • Size 158KB
                                                                                  • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  ldsajdklsajdlkjsalkda.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                  • Size 589B
                                                                                  • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  qpxuwx.exe
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\qpxuwx.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 4ba5b12358bd799e46edbe687f1cc1f733a96f227d097942a5a29e8b6018814e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  messages.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3880_1859678339\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                  • Size 711B
                                                                                  • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  content.js
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3880_2083401463\CRX_INSTALL\content.js
                                                                                  • Size 9KB
                                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  aba96943-2309-455a-a9cd-30828f43fbc8.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3880_2083401463\aba96943-2309-455a-a9cd-30828f43fbc8.tmp
                                                                                  • Size 10KB
                                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  182739.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\182739.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 c4ea5c53693f1b54c38b786f74ba7d5368060174f6f7773438e775bed7645634
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  198561.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\198561.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 eee289d32355b1644825ae15222e14295f7d643d99627c7f21a409cf5fcf4ff7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  211819.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\211819.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 2037e5aa1d484695d6031e7e2067018779a4bf15bb38be3b82680101b3eba953
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  247326.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\247326.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 c4e36ae6371ddb9e2d83eb2373b59561f30aa9770bcf822ef056dd2643d01eb1
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  324095.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\324095.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 fe4033e8eee7d3e330e05788113225d71b33546d3b32e044062675184cdb8de2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  329611.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\329611.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 4881fd956c7fb5c3777de41323e1310f257c898d8a5b644b058f4ba2e305a48f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  451997.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\451997.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 6a33b06346bd418dd9ed1df26b06bfcf897c58c0d5385f5af508c8ba4f399fa8
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  557753.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\557753.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 e0855e5f222052121455dea22565deaf6a5d54fc37d8a4713ca0de55f8a49720
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  608049.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\608049.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 d223a149100a924eed29e57a94db73ae7108dc7711d65cc2c7bd1142b4393b64
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  800774.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\800774.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 10ae07544f075372ab04833da94ef11b161671199280744ac579b3fce6e1d8b6
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  844021.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\844021.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 de304a76507cb18830521004bb2e0880d42d65e6d3239563fa25963fc80b74e6
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  979538.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\979538.exe
                                                                                  • Size 1.5MB
                                                                                  • SHA256 e7049a878c6c718fae0a6218e72594ce31ad5488f845a5bc9307086abef4522b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  memory/3568-1590-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3568-1647-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3568-522-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3568-1755-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3568-1550-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3568-1486-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3568-1424-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download

                                                                                  memory/3896-226-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                  Download